Submission of Mental Health Records to NICS and the HIPAA Privacy Rule
Released: 2014-02-20T00:00:00

Summary:
Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings. These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more "prohibiting factors," such as a prior felony conviction or a prior involuntary commitment for mental health reasons. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS) and a particular focus of the debate in Congress has been whether federal privacy standards promulgated under the Health Insurance Portability and Accountability Act (i.e., the HIPAA Privacy Rule) or state privacy laws are an obstacle to the submission of mental health records to NICS.
Under the Gun Control Act of 1968 (GCA), as amended, persons adjudicated to be mentally defective or who have been committed to a mental institution are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. Neither a diagnosis of a mental illness nor treatment for a mental illness is sufficient to qualify a person as "adjudicated as a mental defective." Rather, an individual's "adjudication as a mental defective" relies upon a determination or decision by a court, board, commission, or other lawful authority. The definition of "committed to a mental institution" may apply only to inpatient settings. At least one federal court has held that the Supreme Court's recent recognition of an individual right to possess a firearm suggests that some emergency hospitalization or commitment procedures, that may not have as many procedural safeguards as formal commitment, should not be included within the meaning of "involuntary commitment" for purposes of the GCA. In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms.
In 2012, the Government Accountability Office (GAO) reported that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states' ability to report mental health records to NICS. The HIPAA Privacy Rule, which applies to most health care providers, regulates the use or disclosure of protected health information, and it has been perceived as a potential obstacle to sharing information with NICS, especially in states that do not expressly require disclosure of such records to NICS. Moreover, courts and health care providers that generate such prohibiting mental health records may also be subject to state health privacy laws that may be more restrictive than the HIPAA Privacy Rule.
In February 2013, the Department of Health and Human Services (HHS) announced its intention to amend the HIPAA Privacy Rule to remove any potential impediments to state reporting of some mental health records to NICS, and on January 7, 2014, HHS issued its proposed rule that would modify the HIPAA Privacy Rule. The Department of Justice (DOJ) also issued a proposed rule that would clarify the terms "adjudicated as a mental defective" and "committed to a mental institution."

paragraphs: Questions about the scope and efficacy of the background checks required during certain firearm purchases have gained prominence following recent mass shootings. These background checks are intended to identify whether potential purchasers are prohibited from purchasing or possessing firearms due to one or more "prohibiting factors," such as a prior felony conviction or a prior involuntary commitment for mental health reasons. If disqualifying information surfaces during the background check, the transfer is not completed. Operationally, such background checks primarily use information contained within the National Instant Criminal Background Check System (NICS), maintained by the Federal Bureau of Investigation (FBI), and a particular focus of the debate in Congress has been whether the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule or state privacy laws are an obstacle to the population of NICS with prohibiting mental health records. On January 7, 2014, the Department of Justice (DOJ) issued a proposed rule that would clarify the existing regulations related to those who would qualify as "adjudicated as a mental defective" and who have been "committed to a mental institution" for purposes of the Gun Control Act of 1968. At the same time, the Department of Health and Human Services (HHS) issued a proposed rule that would clarify when entities that are regulated under HIPAA may share certain information with NICS.
This report provides an overview of prohibiting mental health records under current federal law, and distinguishes those records from other types of mental health information that would not disqualify an individual from purchasing a firearm. This report also provides an overview of NICS and discusses potential issues arising from state and federal medical privacy laws that may impede states' efforts to submit prohibiting mental health records to NICS.
subsections: section_title: Prohibiting Mental Health Factors Under the Gun Control Act of 1968
paragraphs: Under the Gun Control Act of 1968 (GCA) , as amended, certain categories of persons are prohibited from possessing, shipping, transporting, and receiving firearms and ammunition. These nine categories of persons who are prohibited include
1. persons convicted of a crime punishable by a term of imprisonment exceeding one year; 2. fugitives from justice; 3. individuals who are unlawful users or addicts of any controlled substance; 4. persons adjudicated to be mentally defective, or who have been committed to a mental institution; 5. aliens illegally or unlawfully in the United States, as well as those who have been admitted pursuant to a nonimmigrant visa; 6. individuals who have been discharged dishonorably from the Armed Forces; 7. persons who have renounced United States citizenship; 8. individuals subject to a pertinent court order; and 9. persons who have been convicted of a misdemeanor domestic violence offense. 
Of these categories, only the fourth is primarily concerned with mental health issues. The sections below provide a more detailed discussion of the scope of this category's two sub-components: adjudication as a mental defective and commitment to a mental institution.
subsections: section_title: Adjudication as a Mental Defective
paragraphs: As noted above, the GCA prohibits individuals "adjudicated as a mental defective" from possessing, receiving, transferring, or transporting a firearm. The term, not defined in statute, has been interpreted in federal regulation as
(a) A determination by a court, board, commission, or other lawful authority that a person, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease: 
(1) Is a danger to himself or to others; or 
(2) Lacks the capacity to manage his own affairs. 
(b) The term shall include—(1) a finding of insanity by a court in a criminal case, and (2) those persons found incompetent to stand trial or found not guilty by lack of mental responsibility [under the Uniform Code of Military Justice].
It is important to note that despite references to "mental illness" in the definition, neither a diagnosis of a mental illness nor treatment for a mental illness appears, by itself, to qualify a person as "adjudicated as a mental defective." Thus, while a health care provider may provide to a third party (i.e., a court, board, commission, or other lawful authority) an assessment of an individual's mental health for purposes of adjudication, the provision of mental health treatment alone is not considered a determination for purposes of being considered "adjudicated as a mental defective," nor is treatment necessary for the determination. Rather, an individual's "adjudication as a mental defective" relies upon a determination or decision by "a court, board, commission, or other lawful authority."
Physicians and other health care providers generally do not fall within this list of authorized decision-makers, with the exception of certain instances under state law where a health care provider may be authorized by statute to admit a patient to involuntary psychiatric treatment. A health care provider, under these circumstances, could potentially be considered an "other lawful authority," who makes a determination which falls within the federal statute criminalizing firearms possession by an individual who is "adjudicated as a mental defective" or "committed to a mental institution." See discussion below at " Emergency Admission or Hospitalization ." 
Whether the definition of "adjudicated as a mental defective" includes individuals who have been assigned fiduciaries to manage monetary benefits received from a federal agency is subject to interpretation, as illustrated by the different policies of the Department of Veterans Affairs (VA) and the Social Security Administration (SSA). In particular, the definition includes those who are determined "as a result of … condition … [to] lack[] the capacity to manage his own affairs." Accordingly, VA policy requires that an individual who receives VA monetary benefits and who "lacks the mental capacity to manage his or her own financial affairs regarding disbursement of funds without limitation, and is either rated incompetent by VA or adjudged to be under legal disability by a court of competent jurisdiction" be assigned a fiduciary (who manages the money disbursed by VA) and be reported to NICS.
In contrast, SSA does not appear to have a comparable policy for representative payees (i.e., individuals who have been assigned a fiduciary to manage their SSA monetary benefits). In a letter to the Vice President, the National Council on Disability (NCD) urges him to
avoid any proposal to link the Social Security Administration's database of representative payees with the FBI's National Instant Criminal Background Check System (NICS). Whatever merits such a proposal might seem to present, such benefits are outweighed by the inaccurate and discriminatory inference that would result: equating the need for assistance in managing one's finances with a presumption of incapacity in other areas of life.... NCD recommends you ensure that the selection of a representative payee continues to have no implication on other areas of rights beyond financial decision-making.
section_title: Commitment to a Mental Institution
paragraphs: The term "committed to a mental institution" is defined through regulation as
A formal commitment of a person to a mental institution by a court, board, commission, or other lawful authority. The term includes a commitment to a mental institution involuntarily. The term includes commitment for mental defectiveness or mental illness. It also includes commitments for other reasons, such as for drug use. The term does not include a person in a mental institution for observation or a voluntary admission to a mental institution.
The use of the term "institution" suggests that the definition of "committed to a mental institution" may apply only to inpatient settings. The question of whether the definition applies to outpatient commitment was raised following the Virginia Tech shooting in 2007 (see textbox). In either case, the definition explicitly excludes "voluntary admission," and so would not apply to individuals voluntarily seeking treatment for mental illness in any setting. As discussed below, DOJ has proposed a rule that would amend this term to clarify that both inpatient and outpatient commitments are covered.
subsections: section_title: Emergency Admission or Hospitalization
paragraphs: As noted above, state law may authorize a health care provider to admit a patient to involuntary psychiatric treatment, particularly in emergency situations for a brief duration. In these limited instances, it is possible that a health care provider would be considered an "other lawful authority," and the patient receiving involuntary psychiatric treatment would fall within the definition of "committed to a mental institution" for purposes of the GCA. For example, in United States v. Waters , the U.S. Court of Appeals for the Second Circuit held that the involuntary hospitalization of an alleged mentally ill individual pursuant to New York state law met the definition of an "involuntary commitment" for purposes of the GCA, even though the hospitalization was ordered by the director of a hospital upon the certification of two physicians.
However, at least one federal court has held that the Supreme Court's recent recognition of an individual right to possess a firearm in District of Columbia v. Heller , suggests that some emergency hospitalization or commitment procedures should not be included within the meaning of "involuntary commitment" for purposes of the GCA. In United States v. Rehlander , the U.S. Court of Appeals for the First Circuit (First Circuit) considered a Maine law which provides authority for the brief, but involuntary, detention of individuals in mental institutions on the basis of a medical provider's examination and certification that the individual is mentally ill and poses a likelihood of serious harm. In pre- Heller cases, the First Circuit had held that this emergency hospitalization under Maine law qualified as "involuntary commitment" under the GCA. However, because the procedures under state law were ex parte and did not have additional procedural safeguards, the court held that construing the emergency hospitalization procedures to qualify as "involuntary commitment" under the GCA post- Heller would risk depriving individuals of their right to bear arms without sufficient due process. Therefore, the appellate court overturned its earlier decisions and held that such emergency hospitalizations were not "involuntary commitments." 
section_title: DOJ Proposal to Amend "Adjudicated as a Mental Defective" and "Committed to a Mental Institution"
paragraphs: On January 7, 2014, DOJ issued a notice of its proposed rule to amend the definitions of "adjudicated as a mental defective" and "committed to a mental institution." The term "adjudicated as a mental defective" is currently composed of two subsections. The proposed amendment primarily makes changes to the second subsection, which currently provides that the term includes (1) a finding of insanity by a court in a criminal case, and (2) a finding of incompetency to stand trial or a finding of not guilty by lack of mental responsibility pursuant to the Uniform Code of Military Justice. The proposed rule would amend this part to clarify that the term applies to all courts, not only the military judicial system, that determine an individual to be not guilty by reason of insanity in a criminal case, or guilty but mentally ill, or incompetent to stand trial in a criminal case. Furthermore, the proposed rule adds a third subsection, which would clarify that the term "adjudicated as a mental defective" does not include any person adjudicated but who has subsequently received relief from disability pursuant to federal law (18 U.S.C. §925(c)) or under a state program authorized by federal law. In addition, the term would not include any person who is adjudicated by a federal agency if the adjudication meets certain conditions. These include if (1) the record has been set aside or the individual has been released from treatment; (2) the person has been found by the court or board to no longer suffer from the condition that was the basis of the adjudication or commitment; or (3) the adjudication or commitment is based solely on a medical finding of disability, without opportunity to be heard by a court or board. 
The second term, "committed to a mental institution," currently covers formal commitments, including those which are involuntary, of a person to a mental institution for mental defectiveness or illness by a court, board, commission, or other lawful authority. It also currently includes commitments for other reasons, including drug use, but does not include a person who is in a mental institution either voluntarily or only for observation. DOJ's proposed rule would maintain the existing definition but amend it to reflect that such commitments include "an involuntary commitment to a mental institution for inpatient or outpatient treatment." The term would continue to exclude those who are in a mental institution solely for observation or evaluation, as well as those who have voluntarily admitted themselves. The proposed rule clarifies that the term also excludes persons undergoing voluntary outpatient treatment. In its notice, DOJ explains that "temporary admission for observation" would not be included under the term unless it "turns into a qualifying commitment as a result of formal commitment by a court, board, commission or other lawful authority." This explanation and the proposed minor changes to the definition would seem to strongly suggest that emergency hospitalizations, as discussed above, are to be excluded. However, the proposed rule does not appear to include explicit language that could provide more guidance to the states or the courts regarding the types of involuntary commitments made by physicians, who are acting as an "other lawful authority," that would be included under the term. 
Lastly, in its notice, DOJ commented that it is seeking comment on whether it should include commitments or adjudications that occurred when the person was under the age of 18. 
section_title: The National Instant Criminal Background Check System (NICS)
paragraphs: Under the Brady Handgun Violence Prevention Act of 1993 (Brady Act), the Attorney General was required to establish a computerized system to facilitate background checks on individuals seeking to acquire firearms from federally licensed firearms dealers. The National Instant Criminal Background Check System (NICS) was activated in 1998 and is administered by the Federal Bureau of Investigation (FBI). Through NICS, federal firearms licensees submit background checks on prospective transferees to the FBI, which queries other databases—including the National Crime Information Center (NCIC), the Interstate Identification Index (III), and the NICS index—to determine if the transferees are disqualified from receiving firearms. According to the FBI, records in the NICS Index are voluntarily provided by local, state, tribal, and federal agencies, and it "contains [disqualifying records] that may not be available in the NCIC or the III of persons prohibited from receiving firearms under federal or state law."
The Brady Act also authorized the Attorney General to "secure directly from any [federal] department or agency of the United States" information on persons for whom receipt of a firearm would violate federal or state law. The act does not mandate that federal agencies disclose these records, rather it mandates that "upon request of the Attorney General, the head of such department or agency shall furnish such information to the system." With respect to states, which are not required to submit records to NICS, the Brady Act provided grants to "improv[e] State record systems and the sharing ... of the records ... required by the Attorney General under [the Brady Act]." However, it did not mandate that states turn over any specific records, even upon request. 
subsections: section_title: NICS Improvement Amendments Act of 2007 (NIAA)
paragraphs: In 2007, Congress passed the NICS Improvement Amendments Act (NIAA), which authorizes the Attorney General to make additional grants to states to improve electronic access to records as well as to incentivize states to turn over records of persons who would be prohibited from possessing or receiving firearms under 18 U.S.C. §922(g) or (n), with an emphasis on providing accurate records relating to those who are prohibited under (g)(4) ("adjudicated as a mental defective") or (g)(9) (" convicted in any court of a misdemeanor crime of domestic violence " ) . Moreover, it mandates that the Department of Homeland Security make available to the Attorney General any records that are related to being a prohibited possessor under federal law. 
subsections: section_title: Federal Agencies and NIAA
paragraphs: For federal agencies, NIAA clarifies the standard for adjudication and commitments related to mental health. It provides that no department may provide any such record if (1) the record has been set aside or the individual has been released from treatment; (2) the person has been found by the court or board to no longer suffer from the condition that was the basis of the adjudication or commitment; or (3) the adjudication or commitment is based solely on a medical finding of disability, without opportunity to be heard by a court or board. It also requires agencies that do make such determinations to establish a program that permits a person to apply for relief from the disabilities imposed under §922(g)(4). 
In January 2013, President Obama issued a memorandum directing all federal agencies to coordinate with the Attorney General in order to provide to NICS any relevant records, including criminal histories and information related to persons prohibited from possessing firearms for mental health reasons. One year later, the White House announced that since 2013 federal agencies have made over 1.2 million additional records available to NICS.
section_title: States and NIAA
paragraphs: With respect to states, NIAA allows a state to be eligible for a two year waiver of the matching requirement in the National Criminal History Improvements Grant program, established under the Brady Act, if the state provides at least 90% of the records relevant to determining whether a person is disqualified from possessing a firearm under federal or applicable state law. To be eligible for such a waiver, other requirements include providing updates to NICS regarding any record that should be modified or removed from the system, and more detailed information regarding those who are convicted of a misdemeanor crime of domestic violence or adjudicated as a mental defective under federal law. 
NIAA also provides the Attorney General discretion to award additional grants for purposes of assisting states with upgrading information identification technologies for firearms disability determinations as long as they have implemented a relief from disabilities program that meets certain requirements. This grant program is known as the NICS Act Record Improvement Program (NARIP). If a state has received a waiver or an additional grant under NIAA, the act imposes penalties for non-compliance. The act mandates reductions in Department of Justice Byrne Justice Assistance Grant funds and permits the Attorney General to make discretionary reduction of these funds if a state does not comply with eligibility requirements of NIAA. 
section_title: State Reporting of Prohibiting Mental Health Records to NICS
paragraphs: In 2012, five years after the NIAA was enacted, the Government Accountability Office (GAO) released a report that examined states' progress in reporting mental health records to the NICS databases. The "mental health records" reported to NICS include only individual identifiers and no actual medical information. However, as discussed in more detail below, the preparation and submission of such records by health departments and health care facilities involves the use of patient information and thus is subject to federal and, in many instances, state health privacy laws.
GAO found that the total number of mental health records that states made available to NICS databases increased approximately nine-fold from about 126,000 to 1.2 million between 2004 and 2011. However, this increase largely reflected the efforts of 12 states. According to GAO, almost half of all states increased the number of mental health records they reported by fewer than 100 over the same time period.
Both DOJ and state officials told GAO that a variety of technological, coordination, and legal (i.e., privacy) challenges limit the states' ability to report mental health records. Technological challenges include updating aging computer systems and integrating existing record systems. Several states reported using their NARIP grant funding to automate the collection and transmission of records. DOJ officials further emphasized that the technological challenges
are particularly salient for mental health records because these records originate from numerous sources within the state—such as courts, private hospitals, and state offices of mental health—and are not typically captured by any single state agency. For example, records that involve involuntary commitments to a mental institution typically originate in entities located throughout a state and outside the scope of law enforcement, and therefore a state may lack processes to automatically make these records available to the FBI.
The fact that mental health records often originate in hospitals and health departments, which are typically not connected to law enforcement agencies that make the majority of records available to NICS, presents challenges in getting all the relevant entities to collaborate. As an example, GAO cited an April 2012 report by the state of Illinois, Office of the Auditor General, which found that for 2010, approximately 114,000 mental health records were maintained in nursing homes, private hospitals, state mental health facilities, and circuit courts. However, only about 5,000 records were reported to NICS because of a lack of coordination and other challenges. Citing privacy concerns, officials in three of the six states reviewed by GAO reported that the absence of explicit statutory authority to share mental health records was an impediment to NICS reporting. 
In a November 2011 report on NICS reporting, Mayors Against Illegal Guns (MAIG) drew conclusions that are broadly similar to those of GAO. MAIG interviewed officials in all 50 states and the District of Columbia and found that state reporting of mental health records to NICS is impeded by a complex set of obstacles including technological and logistical problems, privacy concerns, insufficient funding, and a lack of leadership. The MAIG report noted that even among states with strong reporting programs, there is considerable variation in the number and type of mental health records submitted to NICS. It found that states that have significantly improved their reporting in the past few years share a number of common attributes including the ability to commit funding to their efforts and effective political leadership. MAIG also found a strong association between reporting levels and enactment of state laws that require or authorize agencies to report their records. According to MAIG, nine of the 10 states that had the greatest increase in records submitted to NICS between September 2010 and October 2011 have laws or policies requiring or permitting sharing mental health records with NICS.
section_title: Impact of the HIPAA Privacy Rule on NICS Reporting
paragraphs: Officials in approximately half of the states told MAIG that state health privacy laws as well as the Privacy Rule promulgated by the Department of Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA) were potential obstacles to NICS reporting. In some states, officials cited privacy concerns as the primary impediment to reporting.
subsections: section_title: HIPAA Privacy Rule Overview
paragraphs: The HIPAA Privacy Rule established a set of federal standards to help safeguard the privacy of personal health information. Those standards include certain individual privacy rights, such as the right of access to one's health information and the right to request corrections, as well as limitations on the use or disclosure of personal health information. The rule applies to (1) health plans; (2) health care clearinghouses; and (3) health care providers who transmit health information electronically in connection with one of the HIPAA-covered financial or administrative transactions. These persons and organizations are collectively referred to as covered entities. 
The Privacy Rule covers protected health information (PHI) in any form that is created or received by a covered entity. PHI is defined as individually identifiable information that relates to the past, present, or future physical or mental health of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
In the broadest sense, the Privacy Rule prohibits a covered entity from using or disclosing PHI except as expressly permitted or required by the rule. As briefly outlined below, the rule describes a range of circumstances under which it is permissible to use or disclose PHI. In all such instances covered entities can choose whether to use or disclose PHI based on their professional ethics and best judgment. The rule specifies only two circumstances when a covered entity is required to disclose PHI. A covered entity must disclose PHI to (1) the individual who is the subject of the information (i.e., patient right of access), and (2) HHS officials investigating potential violations of the rule. For a discussion on the proposed modification to the HIPAA Privacy Rule, see " HHS Proposal to Amend HIPAA Privacy Rule ."
Generally, covered entities may use or disclose PHI for the purposes of treatment, payment, and other routine health care operations with few restrictions. Under other specific circumstances (e.g., disclosures to family members and friends), the rule requires covered entities to give the individual the opportunity to object to the disclosure (i.e., opt out). Importantly, the rule also permits the use or disclosure of PHI for several specified "national priority purposes" that are not directly connected to the treatment of the individual. These uses and disclosures are permitted by the rule in recognition of the important uses made of health information outside of the health care context. They include the following uses and disclosures:
Required by law. Covered entities may use or disclose PHI to the extent that such use or disclosure is required by (federal or state) law and the disclosure complies with and is limited to the relevant requirements of such law. Law enforcement purposes. Covered entities may disclose PHI to law enforcement officials for certain specified law enforcement purposes. Averting a serious threat to health or safety. Consistent with applicable law and standards of ethical conduct, a health care provider may use or disclose PHI if the provider in good faith believes the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Specialized government functions. Covered entities may use or disclose PHI for several specified essential government functions.
For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered entities must obtain a patient's written authorization.
As discussed above, prohibiting mental health records under the GCA are typically generated by the courts that adjudicate persons as mentally defective, and by the courts and health care providers that involuntarily commit individuals to mental health facilities. While courts are not covered entities and are not subject to the HIPAA Privacy Rule, health care providers such as hospitals and state health departments are covered by the Privacy Rule and, therefore, may not use or disclose PHI for the purpose of NICS reporting without express permission under the rule. As described below, it is necessary to look to the states to determine whether such permission exists.
subsections: section_title: Interaction of HIPAA Privacy Rule and State Privacy Laws
paragraphs: Although the HIPAA Privacy Rule provides a federal floor with respect to the uses and disclosures of PHI, the overall scope of the Privacy Rule may be modulated by state law. If a state requires covered entities to disclose prohibiting mental health records to NICS, the HIPAA Privacy Rule does not prohibit that disclosure. Therefore, the Privacy Rule is most relevant as a potential obstacle where prohibiting mental health records are held by covered entities in a state that does not require disclosure of such records to NICS. This would be the case even if the state expressly allowed, but did not explicitly require, disclosure of prohibiting mental health records to NICS because merely permissive state laws are insufficient to exempt disclosure from the HIPAA Privacy Rule. As discussed below, HHS has proposed amendments to the HIPAA Privacy Rule that would permit disclosure to NICS where a state has a permissive disclosure law.
It should also be noted that both types of entities—courts and health care providers—may also be subject to state health privacy laws that may be more protective of individually identifiable health information than the HIPAA Privacy Rule and other state-level requirements and policies. State laws that are more protective of privacy include those that prohibit or restrict a use or disclosure that would otherwise be permitted under the Privacy Rule, and those that provide individuals with greater access to their own health information. This final section of the report provides a basic overview of the different types of state privacy laws that may impact the sharing of prohibiting mental health records with NICS.
 Figure 1 summarizes state laws, as of January 1, 2013, that address the reporting of mental health records for use in firearm purchaser background checks. Twenty-three states have NICS reporting mandates. These laws require courts and, in some instances, mental health facilities to report (1) to NICS directly, or (2) to a state agency that in turn reports to NICS. As noted above, the HIPAA Privacy Rule would not bar the mandated disclosures in these states. Note that in one of the states—Delaware—reporting by mental health facilities takes the place of court reporting (see Figure 1 ). 
Seven states have laws that authorize, but do not require, reporting to NICS. In these states that do not mandate reporting, HIPAA-covered entities do not appear to have permission under the Privacy Rule to use or disclose PHI for the purpose of preparing and reporting mental health records to NICS. Absent a state reporting mandate, it is not clear that there are any other provisions in the Privacy Rule that provide such permission. 
None of the three other national priority purposes in the Privacy Rule discussed earlier (under "HIPAA Privacy Rule Overview") address reporting to federal databases for the purposes of future background checks. The disclosure of PHI for law enforcement purposes has to be (1) as required by law; (2) pursuant to various specified judicial and administrative processes and procedures such as court orders, subpoenas, and summonses; or (3) in response to one of several other specified law enforcement activities. The Privacy Rule's provisions authorizing the use or disclosure of PHI for various specialized government functions list a number of specific activities, none of which includes reporting information to the NICS databases. Finally, the rule's provisions that permit the use and disclosure of PHI to avert a serious threat to health or safety focus on two types of situations, neither of which appears to include NICS reporting. The first permits the disclosure of PHI to a person or persons reasonably able to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. The second concerns alerting law enforcement authorities about an individual involved in a violent crime or who has escaped from prison or lawful custody. 
An additional eight states collect mental health records pursuant to state law, but these laws do not address NICS reporting. Again, without a NICS reporting mandate, HIPAA-covered entities do not appear to have permission under the Privacy Rule to use PHI for the purpose of reporting mental health records to the federal databases. These states include California, which despite the absence of a NICS reporting mandate, has one of the best NICS reporting rates for mental health records. In part this is because of a state law that requires mental health facilities to report mental health records to the California Department of Justice (DOJ). That requirement effectively removes HIPAA as an impediment to such reporting by HIPAA-covered entities. While state law is silent on DOJ reporting to NICS, California has developed a reporting infrastructure and entered into an agreement with the federal government to report mental health records to NICS.
Finally, 13 states are without laws requiring or authorizing the collection or reporting of mental health records for use in firearm purchaser background checks, either at the state or federal level. Once again, HIPAA-covered entities in these states that are in possession of disqualifying mental health records appear to lack the authority under the Privacy Rule to report such information to NICS.
While a detailed examination of state-level activities is beyond the scope of this report, it should be emphasized that many states collect and use mental health records (and other relevant information) pursuant to state law or policies for their own background checks of firearm purchases. Some states are "Point-Of-Contact" (POC) states, meaning that the state agency is responsible for electronically accessing NICS and for implementing and maintaining their own Brady NICS program. Often times a POC state will run the background check against the state's own records, some of which may not be in NICS. In some instances, background checks conducted by POCs may be more stringent than non-POC states because they have access to more access to disqualifying records. In addition, these states could be more thorough in their background checks because statutory prohibitions on firearm possession in these states sometimes exceed the federal prohibitions under the Brady Act. However, unlike the nationwide NICS background checks, state-level checks do not capture prohibited individuals who cross state lines to purchase long guns.
section_title: HHS Proposal to Amend HIPAA Privacy Rule
paragraphs: On January 7, 2014, HHS's Office for Civil Rights (OCR), which administers and enforces the Privacy Rule, issued a proposed rule that would modify the HIPAA Privacy Rule "to expressly permit certain HIPAA covered entities to disclose" to NICS the identities of certain individuals who are subject to the mental health disqualification under the GCA.
Relying on its authority under HIPAA, which provides HHS with discretion to modify the privacy standards as appropriate but not more than once a year, HHS proposes to add a new, narrowly tailored provision to the Privacy Rule that would expressly " permit [not require] certain covered entities to disclose the minimum necessary demographic and other information for NICS reporting purposes, which would not include clinical, diagnostic, or other mental health information" (emphasis added). The modification is meant to "produce clarity regarding the Privacy Rule and help make it as simple as possible for States to report the identities of such individuals to the NICS." It would not affect the currently existing permitted uses and disclosures of PHI under the Privacy Rule, as discussed above.
The rule would allow only HIPAA-covered entities to report individuals who are prohibited under the federal mental health prohibitor (18 U.S.C. §922(g)(4)) and not for other disqualifying factors under the GCA. In other words, a covered entity would not be permitted to disclose identifying information to NICS for an individual who is prohibited from possessing a firearm under 18 U.S.C. §922(g)(3)—that is, an unlawful user of, or a person who is addicted to, any controlled substance—except to the extent that such drug use is connected to being "committed to a mental institution." HHS also notes that states may have a broader mental health prohibition related to firearms, and that information related to these state prohibitors may not be reported to NICS. HHS also seeks comment from states related to the scope of the proposed rule on whether HIPAA is currently perceived as a barrier to reporting to NICS about individuals who are subject to state law firearm prohibitions and whether the final rule should address this aspect. HHS explains, however, that broadening the scope to also encompass state law mental health prohibitors could increase the likelihood that more treating providers would be permitted to report information to NICS. As currently drafted, the new provision primarily aims to cover HIPAA-covered entities performing the relevant commitment, adjudicatory, or repository functions, and not those performing solely treatment functions.
Other areas where HHS seeks public comment for purposes of the final rule include
whether there are states in which a type of entity not described in the proposed paragraph is responsible for NICS reporting and is one that needs to be able to receive NICS data from HIPAA-covered entities; whether, and in what circumstances, HIPAA-covered entities or other entities such as courts currently report to a records repository or directly to NICS information that is not listed in the proposed rule; what types of additional data elements—such as Social Security number, place of birth, state of residence, physical description—that HHS may permit disclosure of for purposes of reporting to NICS; and the types of additional guidance that OCR and/or NICS could issue that would be helpful for understanding the proposed rule. 
Should the proposed amendments to the HIPAA Privacy Rule become final, there may be a gradual increase in the number of records shared with NICS by covered entities. It should be noted, however, that states may still lack the infrastructure, capital, or political support to establish a system that allows records to be shared with NICS or an appropriate repository that shares with NICS. 
section_title: Conclusion
paragraphs: During the past few years, questions have arisen with respect to the efficacy of the federal background check that is required for certain firearm transfers. Of particular congressional focus is whether enough records of individuals who are prohibited by federal law from firearm possession because they have been "adjudicated as a mental defective" are being shared with NICS, the system through which background checks are generally conducted. In particular, the question has become whether the HIPAA Privacy Rule or state privacy laws are an obstacle to the population of NICS with prohibiting mental health records. 
Although the HIPAA Privacy Rule currently allows disclosure of information where state law expressly requires disclosure of records to NICS, some state officials have reported that they view state health privacy laws and the HIPAA Privacy Rule as potential obstacles to NICS reporting. In response to these concerns, HHS proposed a rule that would modify the HIPAA Privacy Rule "to expressly permit [but not require] certain HIPAA covered entities to disclose" to NICS the identities of individuals who are subject to the mental health disqualification under federal firearms law. Interestingly, HHS seeks comments from states on whether its proposed rule should also permit HIPAA-covered entities to share records with NICS regarding individuals who are prohibited from firearm possession due to mental health reasons under state firearms laws, the coverage of which may be broader than the federal mental health prohibitor. 
Another question long unaddressed and unclear to states is whether the term "committed to a mental institution" includes individuals who are ordered by a court, board, or other lawful authority to receive outpatient treatment. To clarify this, DOJ also has proposed a rule that would clarify that the term includes both mandatory inpatient and outpatient commitments. Due to the perceived barriers under the HIPAA Privacy Rule, as well as uncertainties in the relevant federal definitions, states have been reluctant to share relevant mental health records with NICS. With clarifications in these areas under way, states could ultimately turn over more relevant records to NICS, though some may still be hindered by deficiencies in their technological capacity to share such records with NICS.