HIPAA Privacy Rule and the National Instant Criminal Background Check System (NICS), 23872-23876 [2013-09602]

Download as PDF 23872 Federal Register / Vol. 78, No. 78 / Tuesday, April 23, 2013 / Proposed Rules (c) Definitions. As used in this section, ‘‘designated representative’’ means a Coast Guard Patrol Commander, including a Coast Guard coxswain, petty officer, or other officer on a Coast Guard vessel or a Federal, State, or local officer designated by or assisting the COTP in the enforcement of the safety zone. (d) Regulations. (1) Under the general regulations in 33 CFR 165.23, entry into, transiting or anchoring within this safety zone is prohibited unless authorized by the COTP or a designated representative. (2) The safety zone is closed to all vessel traffic, except as may be permitted by the COTP or a designated representative. (3) Vessel operators desiring to enter or operate within the safety zone must contact the COTP or a designated representative to obtain permission to do so. Vessel operators given permission to enter or operate in the safety zone must comply with all directions given to them by the COTP or a designated representative. Persons and vessels may request permission to enter the safety zone on VHF–23A or through the 24hour Command Center at telephone (415) 399–3547. Dated: April 1, 2013. Cynthia L. Stowe, Captain, U.S. Coast Guard, Captain of the Port San Francisco. [FR Doc. 2013–09539 Filed 4–22–13; 8:45 am] BILLING CODE 9110–04–P ARCHITECTURAL AND TRANSPORTATION BARRIERS COMPLIANCE BOARD 36 CFR Part 1195 [Docket No. ATBCB–2012–0003] RIN 3014–AA40 Medical Diagnostic Equipment Accessibility Standards Advisory Committee Architectural and Transportation Barriers Compliance Board. ACTION: Notice of advisory committee meeting. AGENCY: The Medical Diagnostic Equipment Accessibility Standards Advisory Committee will hold its sixth meeting. On July 5, 2012, the Architectural and Transportation Barriers Compliance Board (Access Board) established the advisory committee to make recommendations to the Board on matters associated with comments received and responses to erowe on DSK2VPTVN1PROD with PROPOSALS-1 SUMMARY: VerDate Mar<15>2010 15:03 Apr 22, 2013 Jkt 229001 questions included in a previously published Notice of Proposed Rulemaking (NPRM) on Medical Diagnostic Equipment Accessibility Standards. DATES: The Committee will meet on May 7, 2013, from 10 a.m. to 5 p.m. and on May 8, 2013, from 9 a.m. to 2:30 p.m. ADDRESSES: The meeting will be held at the Access Board’s Conference Room, 1331 F Street NW., Suite 800, Washington, DC 20004–1111. FOR FURTHER INFORMATION CONTACT: Rex Pace, Office of Technical and Information Services, Architectural and Transportation Barriers Compliance Board, 1331 F Street NW., Suite 1000, Washington, DC 20004–1111. Telephone number (202) 272–0023 (Voice); (202) 272–0052 (TTY). Electronic mail address: pace@accessboard.gov. SUPPLEMENTARY INFORMATION: On July 5, 2012, the Architectural and Transportation Barriers Compliance Board (Access Board) established an advisory committee to make recommendations to the Board on matters associated with comments received and responses to questions included in a previously published NPRM on Medical Diagnostic Equipment Accessibility Standards. See 77 FR 6916 (February 9, 2012). The NPRM and information related to the proposed standards are available on the Access Board’s Web site at: http:// www.access-board.gov/medicalequipment.htm. The advisory committee will hold its sixth meeting on May 7 and 8, 2013. The agenda includes the following: • Review of previous committee work; • review and discussion of subcommittee recommendations; • review and discussion of committee recommendations; • review and discussion of the committee’s final report; • consideration of issues proposed by committee members; and • discussion of administrative issues. The preliminary meeting agenda, along with information about the committee, is available at the Access Board’s Web site (http://www.accessboard.gov/medical-equipment.htm). Committee meetings are open to the public and interested persons can attend the meetings and communicate their views. Members of the public will have opportunities to address the committee on issues of interest to them during public comment periods scheduled on each day of the meeting. The meetings will be accessible to persons with disabilities. An assistive PO 00000 Frm 00007 Fmt 4702 Sfmt 4702 listening system, Communication Access Realtime Translation (CART), and sign language interpreters will be provided. Persons attending the meetings are requested to refrain from using perfume, cologne, and other fragrances for the comfort of other participants (see www.access-board.gov/ about/policies/fragrance.htm for more information). Also, persons wishing to provide handouts or other written information to the committee are requested to provide electronic formats to Rex Pace via email prior to the meetings so that alternate formats can be distributed to committee members. David M. Capozzi, Executive Director. [FR Doc. 2013–09513 Filed 4–22–13; 8:45 am] BILLING CODE 8150–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 45 CFR Parts 160 and 164 HIPAA Privacy Rule and the National Instant Criminal Background Check System (NICS) Office for Civil Rights, Department of Health and Human Services. ACTION: Advance notice of proposed rulemaking. AGENCY: On January 16, 2013, President Barack Obama announced a series of Executive Actions to reduce gun violence in the United States, including efforts to improve the Federal government’s background check system for the sale or transfer of firearms by licensed dealers, called the National Instant Criminal Background Check System (NICS). Among those persons disqualified from possessing or receiving firearms under Federal law are individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined, through a formal adjudication process, to have a severe mental condition that results in the individuals presenting a danger to themselves or others or being incapable of managing their own affairs (referred to below as the ‘‘mental health prohibitor’’). Concerns have been raised that, in certain states, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule may be a barrier to States’ reporting the identities of individuals subject to the mental health prohibitor SUMMARY: E:\FR\FM\23APP1.SGM 23APP1 erowe on DSK2VPTVN1PROD with PROPOSALS-1 Federal Register / Vol. 78, No. 78 / Tuesday, April 23, 2013 / Proposed Rules to the NICS. The Department of Health and Human Services (HHS or ‘‘the Department’’), which administers the HIPAA regulations, is issuing this Advance Notice of Proposed Rulemaking (ANPRM) to solicit public comments on such barriers to reporting and ways in which these barriers can be addressed. In particular, we are considering creating an express permission in the HIPAA rules for reporting the relevant information to the NICS by those HIPAA covered entities responsible for involuntary commitments or the formal adjudications that would subject individuals to the mental health prohibitor, or that are otherwise designated by the States to report to the NICS. In addition, we are soliciting comments on the best methods to disseminate information on relevant HIPAA policies to State level entities that originate or maintain information that may be reported to NICS. Finally, we are soliciting public input on whether there are ways to mitigate any unintended adverse consequences for individuals seeking needed mental health services that may be caused by creating express regulatory permission to report relevant information to NICS. The Department will use the information it receives to determine how best to address these issues. DATES: Submit comments on or before June 7, 2013. ADDRESSES: Written comments may be submitted through any of the methods specified below. Please do not submit duplicate comments. • Federal eRulemaking Portal: You may submit electronic comments at http://www.regulations.gov. Follow the instructions for submitting electronic comments. Attachments should be in Microsoft Word, WordPerfect, or Excel; however, we prefer Microsoft Word. • Regular, Express, or Overnight Mail: You may mail written comments (one original and two copies) to the following address only: U.S. Department of Health and Human Services, Office for Civil Rights, Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue SW., Washington, DC 20201. • Hand Delivery or Courier: If you prefer, you may deliver (by hand or courier) your written comments (one original and two copies) to the following address only: Office for Civil Rights, Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue SW., Washington, DC 20201. (Because access to the interior of the Hubert H. VerDate Mar<15>2010 15:03 Apr 22, 2013 Jkt 229001 Humphrey Building is not readily available to persons without federal government identification, commenters are encouraged to leave their comments in the mail drop slots located in the main lobby of the building.) Inspection of Public Comments: All comments received before the close of the comment period will be available for public inspection, including any personally identifiable or confidential business information that is included in a comment. We will post all comments received before the close of the comment period at http:// www.regulations.gov. Because comments will be made public, they should not include any sensitive personal information, such as a person’s social security number; date of birth; driver’s license number, state identification number or foreign country equivalent; passport number; financial account number; or credit or debit card number. Comments also should not include any sensitive health information, such as medical records or other individually identifiable health information, or any non-public corporate or trade association information, such as trade secrets or other proprietary information. FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202–205–2292. SUPPLEMENTARY INFORMATION: I. Background On January 16, 2013, President Barack Obama announced 23 Executive Actions aimed at curbing gun violence across the nation. Those actions include efforts by the Federal government to improve the national background check system for the sale or transfer of firearms by licensed dealers, and a specific commitment to ‘‘[a]ddress unnecessary legal barriers, particularly relating to the Health Insurance Portability and Accountability Act, that may prevent states from making information available to the background check system.’’ To better understand the scope of any problems HIPAA may pose to reporting the identities of persons who are subject to the mental health prohibitor to the NICS, where a HIPAA covered entity may hold the records of the involuntary commitments or mental health adjudications, the Department developed this ANPRM to solicit input from States, other stakeholders, and the public on these issues. The public comments will inform the Department’s efforts to address concerns related to HIPAA in a manner that is consistent with our approach to balancing important public safety goals and individuals’ privacy interests. PO 00000 Frm 00008 Fmt 4702 Sfmt 4702 23873 The NICS The Brady Handgun Violence Prevention Act of 1993, Public Law 103–159, and its implementing regulations, are designed to prevent the transfer of firearms by licensed dealers to individuals who are not allowed to possess them as a result of restrictions contained in the Gun Control Act of 1968, as amended (Title 18, United States Code, Chapter 44), and those deemed otherwise unfit to possess or receive firearms. The Gun Control Act identifies several categories (known as ‘‘prohibitors’’) of individuals 1 who are prohibited from engaging in the shipment, transport, receipt, or possession of firearms, including convicted felons and fugitives. Most relevant for the purposes of this ANPRM is the ‘‘mental health prohibitor,’’ which applies to individuals who have been involuntarily committed to a mental institution,2 found incompetent to stand trial or not guilty by reason of insanity, or otherwise adjudicated as having a serious mental condition that results in the individuals presenting a danger to themselves or others or being unable to manage their own affairs.3 The Brady Act established the National Instant Criminal Background Check System (NICS) to help enforce these prohibitions.4 The NICS Index, a database administered by the Federal Bureau of Investigation (FBI), collects and maintains certain identifying information about individuals who are subject to one or more of the Federal prohibitors and thus, are ineligible to 1 See 18 U.S.C. 922(g) and (n) and implementing regulations at 27 CFR 478.11 and 27 CFR 478.32. 2 The regulation, at 27 CFR 478.11, defines ‘‘Committed to a mental institution’’ as: A formal commitment of a person to a mental institution by a court, board, commission, or other lawful authority. The term includes a commitment to a mental institution involuntarily, commitment for mental defectiveness or mental illness, as well as commitments for other reasons, such as for drug use. The term does not include a person in a mental institution for observation or a voluntary admission to a mental institution. 3 The term used in the statute, ‘‘adjudicated as a mental defective,’’ is defined by regulation to include: ‘‘(a) A determination by a court, board, commission, or other lawful authority that a person, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease: (1) is a danger to himself or to others; or (2) lacks the mental capacity to contract or manage his own affairs.’’ The term includes a finding of insanity in a criminal case, and a finding of incompetence to stand trial or a finding of not guilty by reason of lack of mental responsibility pursuant to the Uniform Code of Military Justice. 27 CFR 478.11. 4 See 28 CFR 25.1 through 25.11 (establishing NICS information system specifications and processes) and 27 CFR part 478 (establishing requirements and prohibitions for commerce in firearms and ammunition, including requirements related to conducting NICS background checks). E:\FR\FM\23APP1.SGM 23APP1 23874 Federal Register / Vol. 78, No. 78 / Tuesday, April 23, 2013 / Proposed Rules erowe on DSK2VPTVN1PROD with PROPOSALS-1 purchase firearms.5 The information maintained by the NICS typically is limited to the names of ineligible individuals and certain other identifying information, such as their dates of birth, as well as codes for the submitting entity and the prohibited category that applies to the individual. Other than demographic information about the individual, only the fact that the individual is subject to the mental health prohibitor is submitted to the NICS; underlying diagnoses, treatment records, and other identifiable health information is not provided to or maintained by the NICS. A NICS background check queries the NICS Index and certain other national databases 6 to determine whether a prospective buyer’s identifying information matches any prohibiting records contained in the databases. The potential transfer of a firearm from a Federal Firearms Licensee (FFL) to a prospective buyer proceeds as follows: First, the prospective buyer is required to provide personal information on a Firearms Transaction Record (ATF Form 4473). Unless the prospective buyer has documentation that he or she qualifies for an exception to the NICS background check requirement under 18 U.S.C. 922(t)(3),7 the FFL contacts the NICS— electronically, by telephone, or through a State level point of contact—and provides certain identifying information about the prospective buyer from ATF Form 4473.8 Within about 30 seconds, the FFL receives a response that the firearm transfer may proceed or is 5 Additionally, in 2012 the NICS Index began to include the identities of persons who are prohibited from possessing or acquiring firearms by State law, which in some cases may be more restrictive than Federal law. See Statement Before the Senate Judiciary Committee, Subcommittee on Crime and Terrorism at a hearing entitled, ‘‘The Fix Gun Checks Act: Better State and Federal Compliance, Smarter Enforcement’’ (November 15, 2011), by David Cuthbertson, Assistant Director, Criminal Justice Information Services Division, Federal Bureau of Investigation. Testimony available at: http://www.justice.gov/ola/testimony/112-1/11-1511-fbi-cuthbertson-testimony-re-the-fix-gun-checksact.pdf. 6 The other databases include the Interstate Identification Index, which contains criminal history record information; and the National Crime Information Center, which includes, e.g., information on persons subject to civil protection orders and arrest warrants. Additional information is available at, http://www.fbi.gov/about-us/cjis/ nics/general-information/nics-overview. 7 These exceptions are listed in the ATF regulation at 27 CFR 478.102(d). 8 The form collects the prospective buyer’s name; demographic information such as address, place and date of birth, gender, citizenship, race and ethnicity; and ‘‘yes’’ or ‘‘no’’ answers to questions about the person’s criminal history and other potential prohibitors. The form is available at http://www.atf.gov/forms/download/atf-f-44731.pdf. VerDate Mar<15>2010 15:03 Apr 22, 2013 Jkt 229001 delayed. The transfer is delayed if the prospective buyer’s information matches a record contained in one of the databases reviewed. If there is a match, a NICS examiner reviews the records to determine whether it is in fact prohibiting, and then either: (1) If the record does not contain prohibiting information, advises the FFL to proceed with the transaction; (2) if the record does contain prohibiting information, denies the transaction (due to ineligibility); or (3) if it is unclear based solely on the existing information in the record whether it is prohibiting, delays the transaction pending further research.9 The NICS examiner does not disclose the reason for the determination to the FFL (e.g., the FFL would not learn that the individual was ineligible due to the mental health prohibitor). In case of a delay, if the NICS examiner does not provide a final instruction to the FFL within three business days of the initial background check request, the FFL may, but is not required to, proceed with the transaction.10 Although FFLs are required in most cases to request a background check through the NICS before transferring a firearm to a prospective buyer,11 Federal law does not require State agencies to report to the NICS the identities of individuals who are prohibited by Federal law from purchasing firearms, and not all states report complete information to the NICS. Therefore, the NICS Index does not include information about all individuals who are subject to one or more of the prohibited categories.12 Following the events at Virginia Tech University in 2007, and other tragedies involving the illegal use of firearms, Congress enacted the NICS Improvement Amendments Act (NIAA) of 2008, Public Law 110–180. Among other provisions, the NIAA requires Federal agencies to report to the NICS the identities of individuals known by the agencies to be subject to one or more prohibitors, and it authorizes incentives 9 For example, a ‘‘delay’’ response may mean that further research is required because potentially prohibitive criteria exist, but the matched records are incomplete, See Federal Bureau of Investigation (FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/ general-information/fact-sheet. 10 Some States have waiting periods that also must be complied with before a firearm may be transferred, regardless of whether a proceed response from NICS is received by the FFL within three business days. 11 See 27 CFR 478.102. Exceptions to this requirement are listed in FN 7 above, and in the regulation at 27 CFR 478.102(d). 12 The same is true of the other two databases accessed during a NICS Check, the III and NCIC. State participation and reporting to those databases is also not required. PO 00000 Frm 00009 Fmt 4702 Sfmt 4702 for States to provide such information when it is in their possession. In addition, some States enacted legislation requiring State agencies to report the identities of ineligible individuals to the NICS or to a State level repository responsible for submitting information to the NICS. The HIPAA Privacy Rule and NICS Reporting The Privacy Rule, promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle F—Administrative Simplification, Public Law 104–191, establishes federal protections to ensure the privacy and security of protected health information (PHI) and establishes an array of individual rights with respect to one’s own health information. HIPAA applies to covered entities, which include health plans, health care clearinghouses, and health care providers that conduct certain standard transactions (such as billing insurance) electronically. HIPAA covered entities may only use and disclose protected health information with the individual’s written authorization, or as otherwise expressly permitted or required by the HIPAA Privacy Rule. The Privacy Rule seeks to balance individuals’ privacy interests with important public policy goals including public health and safety. In doing so, the Privacy Rule allows, subject to certain conditions and limitations, disclosures of protected health information without individuals’ authorization for certain law enforcement purposes, to avert a serious threat to health or safety, and where required by State or other law, among other purposes. As stated above, individuals who are subject to the mental health prohibitor are ineligible to purchase a firearm because they have been involuntarily committed to a mental institution, have been found incompetent to stand trial or not guilty by reason of insanity, or otherwise have been determined through an adjudication process to have a severe mental condition resulting in the individuals presenting a danger to themselves or others or being unable to manage their own affairs. Records of individuals adjudicated as incompetent to stand trial, or not guilty by reason of insanity, originate with entities in the criminal justice system, and these entities are not HIPAA covered entities. Likewise, involuntary civil commitments are usually made by court order, and thus, records of such orders originate with entities in the justice system. In addition, many adjudications determining that individuals pose a danger to themselves or others, or are E:\FR\FM\23APP1.SGM 23APP1 erowe on DSK2VPTVN1PROD with PROPOSALS-1 Federal Register / Vol. 78, No. 78 / Tuesday, April 23, 2013 / Proposed Rules incapable of managing their own affairs, occur through legal process in the court system. However, because of the variety of State laws, there may be State agencies, boards, commissions, or other lawful authorities outside the court system that are involved in some involuntary commitments or mental health adjudications. At this time, we have insufficient data regarding to what extent these State agencies, boards, commissions, or other lawful authorities that order involuntary commitments or conduct mental health adjudications are also HIPAA covered entities. Moreover, we understand that some States have designated repositories to collect and report to the NICS the identities of individuals subject to the mental health prohibitor. We also do not have data to determine to what extent any of these repositories is also a HIPAA covered entity (e.g., a State health agency). Where the record of an involuntary commitment or mental health adjudication originated with a HIPAA covered entity, or the HIPAA covered entity is the State repository for such records, the records are subject to HIPAA, but there are ways in which the Privacy Rule permits the reporting to the NICS. In particular, the Privacy Rule permits the agency to disclose the information to the NICS to the extent the State has enacted a law requiring such reporting.13 Alternatively, where there is no State law requiring reporting, the Privacy Rule permits a State agency that is a HIPAA covered entity that performs both health care and nonhealth care functions (e.g., NICS reporting) to become a hybrid entity and thus, have the HIPAA Privacy Rule apply only to its health care functions. The State agency achieves hybrid entity status by designating its health care components as separate from other components and documenting that designation. Thus, a State agency that has designated itself a hybrid entity, in accordance with the Privacy Rule,14 can report prohibitor information through its non-HIPAA covered NICS reporting unit without restriction under the Privacy Rule. However, many States still are not reporting essential mental health prohibitor information to the NICS. Some States may face practical difficulties in passing a State law 13 See 45 CFR 164.512(a). Note that disclosures for NICS purposes would not fall under the Privacy Rule’s provisions permitting disclosures for law enforcement (which apply to specific law enforcement inquiries) or to avert a serious threat to health or safety (which require an imminent threat of harm). See 45 CFR 164.512(f) and (j). 14 See 45 CFR 164.103, 164.105. VerDate Mar<15>2010 15:03 Apr 22, 2013 Jkt 229001 requiring NICS disclosures, and there may be administrative or other challenges to the creation of a hybrid entity. Thus, concerns have been raised that the HIPAA Privacy Rule’s restrictions on covered entities’ disclosures of protected health information may prevent certain States from reporting to the NICS the identities of individuals who are subject to the mental health prohibitor. Further, in July 2012, the U.S. Government Accountability Office (GAO) reported to Congress on the results of a survey of six states that it had conducted as part of a performance audit of the progress made by DOJ and the States in implementing the NIAA.15 In the report, the GAO wrote that, ‘‘* * * officials from 3 of the 6 states we reviewed said that the absence of explicit state-level statutory authority to share mental health records was an impediment to making such records available to NICS.’’ 16 The report also stated that, although the number of records provided by the States to the NICS had increased by 800 percent between 2004 and 2011, this increase was largely due to efforts by only 12 states. The report raised the possibility that States that do not report to the NICS the identities of individuals who are subject to the mental health prohibitor may experience challenges to reporting related to the HIPAA Privacy Rule. To address these concerns, the Department is considering whether to amend the Privacy Rule to expressly permit covered entities holding information about the identities of individuals who are subject to the mental health prohibitor to disclose limited mental health prohibitor information to the NICS. Such an amendment might produce clarity regarding the Privacy Rule and help make it as simple as possible for States to report the identities of such individuals to the NICS. In crafting the elements of an express permission, we would consider limiting the information to be disclosed to the minimum data necessary for NICS purposes, such as the names of the individuals who are subject to the mental health prohibitor, demographic information such as dates of birth, and codes identifying the reporting entity 15 See GAO–12–684, Gun Control: Sharing Promising Practices and Assessing Incentives Could Better Position Justice to Assist States in Providing Records for Background Checks. 16 We note that the GAO Report uses the term ‘‘mental health records’’ to refer to identifying information on individuals who are subject to the mental health prohibitor. To avoid implying that mental health records are collected by NICS, the Department uses the terms ‘‘identities,’’ ‘‘information,’’ or ‘‘data’’ in place of ‘‘mental health records.’’ GAO–12–684, p. 12. PO 00000 Frm 00010 Fmt 4702 Sfmt 4702 23875 and the relevant prohibitor. We would not consider permitting the disclosure of an individual’s treatment record or any other clinical or diagnostic information for this purpose. In addition, we would consider permitting disclosures for NICS purposes only by those covered entities that order involuntary commitments, perform relevant mental health adjudications, or are otherwise designated as State repositories for NICS reporting purposes. To inform our efforts to address any issues in this area, we request comments specifically on the questions below, which will help us identify the nature and scope of the problem of underreporting, determine whether our assumptions about where data are maintained are correct, determine to what extent the existing permissible disclosures are insufficient, and explore additional methods of disseminating information about whether the HIPAA Privacy Rule affects entities’ ability to report to the NICS. The Department welcomes comments from all stakeholders on these issues, including HIPAA covered entities; agencies of State, territorial, and tribal governments; law enforcement officials; individuals; and consumer advocates and groups. We are particularly interested in specific examples of situations in which reporting to the NICS is hindered by HIPAA requirements, or where there may be uncertainty about how HIPAA applies to such reporting, and any other concerns about the disclosure of information for these purposes by health care entities that both perform the adjudications or involuntary commitments and provide the mental health treatment to the individuals. We ask that commenters indicate throughout their submitted comments which question(s) they are responding to. II. Questions In a 2012 report on implementation of the NIAA, the GAO wrote that States had increased reporting to the NICS of the identities of individuals who are prohibited from purchasing firearms because they have been involuntarily committed to a mental institution, found incompetent to stand trial or not guilty by reason of insanity, or otherwise adjudicated as having a serious mental condition that results in the individuals posing a danger to themselves or others or being unable to manage their own affairs.17 Specifically, reporting of this information grew from 126,000 records in October 2004, to 17 GAO–12–684, E:\FR\FM\23APP1.SGM 23APP1 p. 9. erowe on DSK2VPTVN1PROD with PROPOSALS-1 23876 Federal Register / Vol. 78, No. 78 / Tuesday, April 23, 2013 / Proposed Rules approximately 1.2 million in October 2011. The GAO also indicated that just 12 states were responsible for the majority of this increase, having reported the identities of at least 10,000 individuals who are subject to the mental health prohibitor by 2011.18 As of February 2013, the number of records was over 2.7 million.19 Despite improvements in reporting, only a small proportion of the records of individuals who are subject to the mental health prohibitor have been reported to the NICS. We invite comment on the following questions relating to States’ participation in NICS reporting and other related issues. 1. Does your State routinely report the identities of individuals who are subject to the Federal mental health prohibitor to the NICS? 2. If your State does not routinely report the identities of such individuals to the NICS, what are the primary reasons for not doing so? a. To what extent, if any, is the HIPAA Privacy Rule perceived as a barrier to your participation? If HIPAA is seen as a barrier, please specify in what way(s) HIPAA may prevent NICS reporting or make reporting difficult. (For example, does HIPAA pose a barrier with respect to only certain types of adjudications?) b. Are there other legal barriers (e.g., State law)? 3. If your State does routinely report the identities of such individuals to the NICS, did you have to overcome any obstacles to your reporting? How did your State overcome those obstacles? a. If the HIPAA Privacy Rule was perceived as a barrier to your participation, what did you do to meet HIPAA requirements? b. If State privacy laws were perceived as a barrier to your participation, what did you do to meet State requirements? c. Please describe any statutory or regulatory changes adopted by your State. To what extent do any changes in State law address the requirements of Federal and/or State privacy laws? We understand that some States may have designated a particular State agency or other entity to collect and maintain NICS information and report to the NICS on a regular basis. We request comments on the following related questions. 4. Has your State designated one or more agencies as State repositories for information about the identities of 18 GAO–12–684, p. 10. Active Records in the NICS Index as of February 28, 2013, http://www.fbi.gov/about-us/ cjis/nics/reports/20130205_nics-index.pdf. 19 FBI, VerDate Mar<15>2010 15:03 Apr 22, 2013 Jkt 229001 individuals who are subject to the mental health prohibitor? If so, please identify the agencies and specify, for each such agency, whether it is a HIPAA covered entity. 5. If HIPAA applies to the repository, how has your State addressed HIPAA requirements while fulfilling its NICS reporting function (e.g., do you have a State law that requires reporting, or has your State created a hybrid entity to isolate the reporting function from the health care component of the repository agency)? 6. If the HIPAA Privacy Rule were to be amended to expressly permit disclosures of the identities of individuals covered by the mental health prohibitor to the NICS Index, would you still face any barriers to reporting? If so, what are they? As discussed above, in many cases, information on the identities of persons who are subject to the mental health prohibitor originates with entities outside the health care sector that are not subject to HIPAA. Still, we recognize that authority to make these determinations is a matter of State law and, therefore, the process may vary from State to State. Thus, there may be instances in which these types of adjudications are made by State agencies or private parties within the health care system. We request comments on the following matters. 7. Are there situations in your State in which a HIPAA covered entity (e.g., a physician, a hospital, or another entity in the health care system), or a component of a larger organization that is a covered entity (e.g., a State health department), has legal authority to involuntarily commit a person to a mental institution—without review or a final action being made by a court? If so, what types of involuntary commitments can be ordered by these authorities? 8. Are there situations in your State in which a HIPAA covered entity (e.g., a physician, a hospital, or another entity in the health care system), or a component of a larger organization that is a covered entity (e.g., a State health department), has legal authority to make a formal adjudication that an individual has a serious mental condition that results in a finding of danger to self or others or an inability to manage affairs— without review or a final action being made by a court? If so, what types of adjudications can be made by these authorities? 9. If HIPAA applies to the entity conducting the relevant mental health adjudications, how has your State addressed HIPAA requirements while fulfilling its NICS reporting function (e.g., do you have a State law that PO 00000 Frm 00011 Fmt 4702 Sfmt 9990 requires reporting, or has your State created a hybrid entity to isolate the reporting function from the health care component of the repository agency)? 10. If the HIPAA Privacy Rule were to be amended to expressly permit disclosures of the identities of individuals covered by the mental health prohibitor to the NICS, would you still face any barriers to reporting? If so, what are they? As the Federal government works to improve reporting to the NICS to ensure comprehensive background checks for firearms purchases, HHS also must continue to fulfill its mandate to protect individuals’ health information privacy rights. Therefore, we request public input on the following issues and any other relevant considerations. 11. Are there privacy protections in place, under State law or otherwise, for data collected by State entities for reporting to the NICS? Would any State public records laws apply to make this data publicly available, or prohibit the reporting to the NICS? 12. We recognize a heightened need for confidentiality because of the sensitivity of, and the stigma attached to, mental health conditions. Are there implications for the mental health community, or for the treatment/care of consumers of mental health services, in having the identities of individuals who are subject to the mental health prohibitor reported for NICS purposes by health care entities that perform both adjudication and treatment functions? If so, what are those implications? 13. Are there ways that HHS may address or mitigate any unintended adverse consequences, for individuals seeking needed mental health services, that may be caused by creating express regulatory permission to report relevant information to the NICS? 14. How can HHS better disseminate information to States on HIPAA Privacy Rule policies as they relate to NICS reporting? Are there central points of contact at the State level that are able to receive and share this information with entities that serve in an adjudicatory or repository capacity? 15. Are there any additional guidance materials and/or training from HHS on particular aspects of the Privacy Rule that would be helpful to address any confusion regarding HIPAA requirements and help improve NICS reporting? Dated: April 16, 2013. Leon Rodriguez, Director, Office for Civil Rights. [FR Doc. 2013–09602 Filed 4–19–13; 4:15 pm] BILLING CODE 4153–01–P E:\FR\FM\23APP1.SGM 23APP1

Agencies

[Federal Register Volume 78, Number 78 (Tuesday, April 23, 2013)]
[Proposed Rules]
[Pages 23872-23876]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2013-09602]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164


HIPAA Privacy Rule and the National Instant Criminal Background 
Check System (NICS)

AGENCY: Office for Civil Rights, Department of Health and Human 
Services.

ACTION: Advance notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: On January 16, 2013, President Barack Obama announced a series 
of Executive Actions to reduce gun violence in the United States, 
including efforts to improve the Federal government's background check 
system for the sale or transfer of firearms by licensed dealers, called 
the National Instant Criminal Background Check System (NICS). Among 
those persons disqualified from possessing or receiving firearms under 
Federal law are individuals who have been involuntarily committed to a 
mental institution; found incompetent to stand trial or not guilty by 
reason of insanity; or otherwise have been determined, through a formal 
adjudication process, to have a severe mental condition that results in 
the individuals presenting a danger to themselves or others or being 
incapable of managing their own affairs (referred to below as the 
``mental health prohibitor''). Concerns have been raised that, in 
certain states, the Health Insurance Portability and Accountability Act 
of 1996 (HIPAA) Privacy Rule may be a barrier to States' reporting the 
identities of individuals subject to the mental health prohibitor

[[Page 23873]]

to the NICS. The Department of Health and Human Services (HHS or ``the 
Department''), which administers the HIPAA regulations, is issuing this 
Advance Notice of Proposed Rulemaking (ANPRM) to solicit public 
comments on such barriers to reporting and ways in which these barriers 
can be addressed. In particular, we are considering creating an express 
permission in the HIPAA rules for reporting the relevant information to 
the NICS by those HIPAA covered entities responsible for involuntary 
commitments or the formal adjudications that would subject individuals 
to the mental health prohibitor, or that are otherwise designated by 
the States to report to the NICS. In addition, we are soliciting 
comments on the best methods to disseminate information on relevant 
HIPAA policies to State level entities that originate or maintain 
information that may be reported to NICS. Finally, we are soliciting 
public input on whether there are ways to mitigate any unintended 
adverse consequences for individuals seeking needed mental health 
services that may be caused by creating express regulatory permission 
to report relevant information to NICS. The Department will use the 
information it receives to determine how best to address these issues.

DATES: Submit comments on or before June 7, 2013.

ADDRESSES: Written comments may be submitted through any of the methods 
specified below. Please do not submit duplicate comments.
     Federal eRulemaking Portal: You may submit electronic 
comments at http://www.regulations.gov. Follow the instructions for 
submitting electronic comments. Attachments should be in Microsoft 
Word, WordPerfect, or Excel; however, we prefer Microsoft Word.
     Regular, Express, or Overnight Mail: You may mail written 
comments (one original and two copies) to the following address only: 
U.S. Department of Health and Human Services, Office for Civil Rights, 
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, 
Room 509F, 200 Independence Avenue SW., Washington, DC 20201.
     Hand Delivery or Courier: If you prefer, you may deliver 
(by hand or courier) your written comments (one original and two 
copies) to the following address only: Office for Civil Rights, 
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, 
Room 509F, 200 Independence Avenue SW., Washington, DC 20201. (Because 
access to the interior of the Hubert H. Humphrey Building is not 
readily available to persons without federal government identification, 
commenters are encouraged to leave their comments in the mail drop 
slots located in the main lobby of the building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. We will post all comments 
received before the close of the comment period at http://www.regulations.gov. Because comments will be made public, they should 
not include any sensitive personal information, such as a person's 
social security number; date of birth; driver's license number, state 
identification number or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. Comments also 
should not include any sensitive health information, such as medical 
records or other individually identifiable health information, or any 
non-public corporate or trade association information, such as trade 
secrets or other proprietary information.

FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.

SUPPLEMENTARY INFORMATION:

I. Background

    On January 16, 2013, President Barack Obama announced 23 Executive 
Actions aimed at curbing gun violence across the nation. Those actions 
include efforts by the Federal government to improve the national 
background check system for the sale or transfer of firearms by 
licensed dealers, and a specific commitment to ``[a]ddress unnecessary 
legal barriers, particularly relating to the Health Insurance 
Portability and Accountability Act, that may prevent states from making 
information available to the background check system.'' To better 
understand the scope of any problems HIPAA may pose to reporting the 
identities of persons who are subject to the mental health prohibitor 
to the NICS, where a HIPAA covered entity may hold the records of the 
involuntary commitments or mental health adjudications, the Department 
developed this ANPRM to solicit input from States, other stakeholders, 
and the public on these issues. The public comments will inform the 
Department's efforts to address concerns related to HIPAA in a manner 
that is consistent with our approach to balancing important public 
safety goals and individuals' privacy interests.

The NICS

    The Brady Handgun Violence Prevention Act of 1993, Public Law 103-
159, and its implementing regulations, are designed to prevent the 
transfer of firearms by licensed dealers to individuals who are not 
allowed to possess them as a result of restrictions contained in the 
Gun Control Act of 1968, as amended (Title 18, United States Code, 
Chapter 44), and those deemed otherwise unfit to possess or receive 
firearms. The Gun Control Act identifies several categories (known as 
``prohibitors'') of individuals \1\ who are prohibited from engaging in 
the shipment, transport, receipt, or possession of firearms, including 
convicted felons and fugitives. Most relevant for the purposes of this 
ANPRM is the ``mental health prohibitor,'' which applies to individuals 
who have been involuntarily committed to a mental institution,\2\ found 
incompetent to stand trial or not guilty by reason of insanity, or 
otherwise adjudicated as having a serious mental condition that results 
in the individuals presenting a danger to themselves or others or being 
unable to manage their own affairs.\3\ The Brady Act established the 
National Instant Criminal Background Check System (NICS) to help 
enforce these prohibitions.\4\ The NICS Index, a database administered 
by the Federal Bureau of Investigation (FBI), collects and maintains 
certain identifying information about individuals who are subject to 
one or more of the Federal prohibitors and thus, are ineligible to

[[Page 23874]]

purchase firearms.\5\ The information maintained by the NICS typically 
is limited to the names of ineligible individuals and certain other 
identifying information, such as their dates of birth, as well as codes 
for the submitting entity and the prohibited category that applies to 
the individual. Other than demographic information about the 
individual, only the fact that the individual is subject to the mental 
health prohibitor is submitted to the NICS; underlying diagnoses, 
treatment records, and other identifiable health information is not 
provided to or maintained by the NICS. A NICS background check queries 
the NICS Index and certain other national databases \6\ to determine 
whether a prospective buyer's identifying information matches any 
prohibiting records contained in the databases.
---------------------------------------------------------------------------

    \1\ See 18 U.S.C. 922(g) and (n) and implementing regulations at 
27 CFR 478.11 and 27 CFR 478.32.
    \2\ The regulation, at 27 CFR 478.11, defines ``Committed to a 
mental institution'' as: A formal commitment of a person to a mental 
institution by a court, board, commission, or other lawful 
authority. The term includes a commitment to a mental institution 
involuntarily, commitment for mental defectiveness or mental 
illness, as well as commitments for other reasons, such as for drug 
use. The term does not include a person in a mental institution for 
observation or a voluntary admission to a mental institution.
    \3\ The term used in the statute, ``adjudicated as a mental 
defective,'' is defined by regulation to include: ``(a) A 
determination by a court, board, commission, or other lawful 
authority that a person, as a result of marked subnormal 
intelligence, or mental illness, incompetency, condition, or 
disease: (1) is a danger to himself or to others; or (2) lacks the 
mental capacity to contract or manage his own affairs.'' The term 
includes a finding of insanity in a criminal case, and a finding of 
incompetence to stand trial or a finding of not guilty by reason of 
lack of mental responsibility pursuant to the Uniform Code of 
Military Justice. 27 CFR 478.11.
    \4\ See 28 CFR 25.1 through 25.11 (establishing NICS information 
system specifications and processes) and 27 CFR part 478 
(establishing requirements and prohibitions for commerce in firearms 
and ammunition, including requirements related to conducting NICS 
background checks).
    \5\ Additionally, in 2012 the NICS Index began to include the 
identities of persons who are prohibited from possessing or 
acquiring firearms by State law, which in some cases may be more 
restrictive than Federal law. See Statement Before the Senate 
Judiciary Committee, Subcommittee on Crime and Terrorism at a 
hearing entitled, ``The Fix Gun Checks Act: Better State and Federal 
Compliance, Smarter Enforcement'' (November 15, 2011), by David 
Cuthbertson, Assistant Director, Criminal Justice Information 
Services Division, Federal Bureau of Investigation. Testimony 
available at: http://www.justice.gov/ola/testimony/112-1/11-15-11-fbi-cuthbertson-testimony-re-the-fix-gun-checks-act.pdf.
    \6\ The other databases include the Interstate Identification 
Index, which contains criminal history record information; and the 
National Crime Information Center, which includes, e.g., information 
on persons subject to civil protection orders and arrest warrants. 
Additional information is available at, http://www.fbi.gov/about-us/cjis/nics/general-information/nics-overview.
---------------------------------------------------------------------------

    The potential transfer of a firearm from a Federal Firearms 
Licensee (FFL) to a prospective buyer proceeds as follows: First, the 
prospective buyer is required to provide personal information on a 
Firearms Transaction Record (ATF Form 4473). Unless the prospective 
buyer has documentation that he or she qualifies for an exception to 
the NICS background check requirement under 18 U.S.C. 922(t)(3),\7\ the 
FFL contacts the NICS--electronically, by telephone, or through a State 
level point of contact--and provides certain identifying information 
about the prospective buyer from ATF Form 4473.\8\ Within about 30 
seconds, the FFL receives a response that the firearm transfer may 
proceed or is delayed. The transfer is delayed if the prospective 
buyer's information matches a record contained in one of the databases 
reviewed. If there is a match, a NICS examiner reviews the records to 
determine whether it is in fact prohibiting, and then either: (1) If 
the record does not contain prohibiting information, advises the FFL to 
proceed with the transaction; (2) if the record does contain 
prohibiting information, denies the transaction (due to ineligibility); 
or (3) if it is unclear based solely on the existing information in the 
record whether it is prohibiting, delays the transaction pending 
further research.\9\ The NICS examiner does not disclose the reason for 
the determination to the FFL (e.g., the FFL would not learn that the 
individual was ineligible due to the mental health prohibitor). In case 
of a delay, if the NICS examiner does not provide a final instruction 
to the FFL within three business days of the initial background check 
request, the FFL may, but is not required to, proceed with the 
transaction.\10\
---------------------------------------------------------------------------

    \7\ These exceptions are listed in the ATF regulation at 27 CFR 
478.102(d).
    \8\ The form collects the prospective buyer's name; demographic 
information such as address, place and date of birth, gender, 
citizenship, race and ethnicity; and ``yes'' or ``no'' answers to 
questions about the person's criminal history and other potential 
prohibitors. The form is available at http://www.atf.gov/forms/download/atf-f-4473-1.pdf.
    \9\ For example, a ``delay'' response may mean that further 
research is required because potentially prohibitive criteria exist, 
but the matched records are incomplete, See Federal Bureau of 
Investigation (FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
    \10\ Some States have waiting periods that also must be complied 
with before a firearm may be transferred, regardless of whether a 
proceed response from NICS is received by the FFL within three 
business days.
---------------------------------------------------------------------------

    Although FFLs are required in most cases to request a background 
check through the NICS before transferring a firearm to a prospective 
buyer,\11\ Federal law does not require State agencies to report to the 
NICS the identities of individuals who are prohibited by Federal law 
from purchasing firearms, and not all states report complete 
information to the NICS. Therefore, the NICS Index does not include 
information about all individuals who are subject to one or more of the 
prohibited categories.\12\
---------------------------------------------------------------------------

    \11\ See 27 CFR 478.102. Exceptions to this requirement are 
listed in FN 7 above, and in the regulation at 27 CFR 478.102(d).
    \12\ The same is true of the other two databases accessed during 
a NICS Check, the III and NCIC. State participation and reporting to 
those databases is also not required.
---------------------------------------------------------------------------

    Following the events at Virginia Tech University in 2007, and other 
tragedies involving the illegal use of firearms, Congress enacted the 
NICS Improvement Amendments Act (NIAA) of 2008, Public Law 110-180. 
Among other provisions, the NIAA requires Federal agencies to report to 
the NICS the identities of individuals known by the agencies to be 
subject to one or more prohibitors, and it authorizes incentives for 
States to provide such information when it is in their possession. In 
addition, some States enacted legislation requiring State agencies to 
report the identities of ineligible individuals to the NICS or to a 
State level repository responsible for submitting information to the 
NICS.

The HIPAA Privacy Rule and NICS Reporting

    The Privacy Rule, promulgated under the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle 
F--Administrative Simplification, Public Law 104-191, establishes 
federal protections to ensure the privacy and security of protected 
health information (PHI) and establishes an array of individual rights 
with respect to one's own health information. HIPAA applies to covered 
entities, which include health plans, health care clearinghouses, and 
health care providers that conduct certain standard transactions (such 
as billing insurance) electronically. HIPAA covered entities may only 
use and disclose protected health information with the individual's 
written authorization, or as otherwise expressly permitted or required 
by the HIPAA Privacy Rule. The Privacy Rule seeks to balance 
individuals' privacy interests with important public policy goals 
including public health and safety. In doing so, the Privacy Rule 
allows, subject to certain conditions and limitations, disclosures of 
protected health information without individuals' authorization for 
certain law enforcement purposes, to avert a serious threat to health 
or safety, and where required by State or other law, among other 
purposes.
    As stated above, individuals who are subject to the mental health 
prohibitor are ineligible to purchase a firearm because they have been 
involuntarily committed to a mental institution, have been found 
incompetent to stand trial or not guilty by reason of insanity, or 
otherwise have been determined through an adjudication process to have 
a severe mental condition resulting in the individuals presenting a 
danger to themselves or others or being unable to manage their own 
affairs. Records of individuals adjudicated as incompetent to stand 
trial, or not guilty by reason of insanity, originate with entities in 
the criminal justice system, and these entities are not HIPAA covered 
entities. Likewise, involuntary civil commitments are usually made by 
court order, and thus, records of such orders originate with entities 
in the justice system. In addition, many adjudications determining that 
individuals pose a danger to themselves or others, or are

[[Page 23875]]

incapable of managing their own affairs, occur through legal process in 
the court system.
    However, because of the variety of State laws, there may be State 
agencies, boards, commissions, or other lawful authorities outside the 
court system that are involved in some involuntary commitments or 
mental health adjudications. At this time, we have insufficient data 
regarding to what extent these State agencies, boards, commissions, or 
other lawful authorities that order involuntary commitments or conduct 
mental health adjudications are also HIPAA covered entities. Moreover, 
we understand that some States have designated repositories to collect 
and report to the NICS the identities of individuals subject to the 
mental health prohibitor. We also do not have data to determine to what 
extent any of these repositories is also a HIPAA covered entity (e.g., 
a State health agency).
    Where the record of an involuntary commitment or mental health 
adjudication originated with a HIPAA covered entity, or the HIPAA 
covered entity is the State repository for such records, the records 
are subject to HIPAA, but there are ways in which the Privacy Rule 
permits the reporting to the NICS. In particular, the Privacy Rule 
permits the agency to disclose the information to the NICS to the 
extent the State has enacted a law requiring such reporting.\13\ 
Alternatively, where there is no State law requiring reporting, the 
Privacy Rule permits a State agency that is a HIPAA covered entity that 
performs both health care and non-health care functions (e.g., NICS 
reporting) to become a hybrid entity and thus, have the HIPAA Privacy 
Rule apply only to its health care functions. The State agency achieves 
hybrid entity status by designating its health care components as 
separate from other components and documenting that designation. Thus, 
a State agency that has designated itself a hybrid entity, in 
accordance with the Privacy Rule,\14\ can report prohibitor information 
through its non-HIPAA covered NICS reporting unit without restriction 
under the Privacy Rule.
---------------------------------------------------------------------------

    \13\ See 45 CFR 164.512(a). Note that disclosures for NICS 
purposes would not fall under the Privacy Rule's provisions 
permitting disclosures for law enforcement (which apply to specific 
law enforcement inquiries) or to avert a serious threat to health or 
safety (which require an imminent threat of harm). See 45 CFR 
164.512(f) and (j).
    \14\ See 45 CFR 164.103, 164.105.
---------------------------------------------------------------------------

    However, many States still are not reporting essential mental 
health prohibitor information to the NICS. Some States may face 
practical difficulties in passing a State law requiring NICS 
disclosures, and there may be administrative or other challenges to the 
creation of a hybrid entity. Thus, concerns have been raised that the 
HIPAA Privacy Rule's restrictions on covered entities' disclosures of 
protected health information may prevent certain States from reporting 
to the NICS the identities of individuals who are subject to the mental 
health prohibitor. Further, in July 2012, the U.S. Government 
Accountability Office (GAO) reported to Congress on the results of a 
survey of six states that it had conducted as part of a performance 
audit of the progress made by DOJ and the States in implementing the 
NIAA.\15\ In the report, the GAO wrote that, ``* * * officials from 3 
of the 6 states we reviewed said that the absence of explicit state-
level statutory authority to share mental health records was an 
impediment to making such records available to NICS.'' \16\ The report 
also stated that, although the number of records provided by the States 
to the NICS had increased by 800 percent between 2004 and 2011, this 
increase was largely due to efforts by only 12 states. The report 
raised the possibility that States that do not report to the NICS the 
identities of individuals who are subject to the mental health 
prohibitor may experience challenges to reporting related to the HIPAA 
Privacy Rule.
---------------------------------------------------------------------------

    \15\ See GAO-12-684, Gun Control: Sharing Promising Practices 
and Assessing Incentives Could Better Position Justice to Assist 
States in Providing Records for Background Checks.
    \16\ We note that the GAO Report uses the term ``mental health 
records'' to refer to identifying information on individuals who are 
subject to the mental health prohibitor. To avoid implying that 
mental health records are collected by NICS, the Department uses the 
terms ``identities,'' ``information,'' or ``data'' in place of 
``mental health records.'' GAO-12-684, p. 12.
---------------------------------------------------------------------------

    To address these concerns, the Department is considering whether to 
amend the Privacy Rule to expressly permit covered entities holding 
information about the identities of individuals who are subject to the 
mental health prohibitor to disclose limited mental health prohibitor 
information to the NICS. Such an amendment might produce clarity 
regarding the Privacy Rule and help make it as simple as possible for 
States to report the identities of such individuals to the NICS.
    In crafting the elements of an express permission, we would 
consider limiting the information to be disclosed to the minimum data 
necessary for NICS purposes, such as the names of the individuals who 
are subject to the mental health prohibitor, demographic information 
such as dates of birth, and codes identifying the reporting entity and 
the relevant prohibitor. We would not consider permitting the 
disclosure of an individual's treatment record or any other clinical or 
diagnostic information for this purpose. In addition, we would consider 
permitting disclosures for NICS purposes only by those covered entities 
that order involuntary commitments, perform relevant mental health 
adjudications, or are otherwise designated as State repositories for 
NICS reporting purposes.
    To inform our efforts to address any issues in this area, we 
request comments specifically on the questions below, which will help 
us identify the nature and scope of the problem of underreporting, 
determine whether our assumptions about where data are maintained are 
correct, determine to what extent the existing permissible disclosures 
are insufficient, and explore additional methods of disseminating 
information about whether the HIPAA Privacy Rule affects entities' 
ability to report to the NICS. The Department welcomes comments from 
all stakeholders on these issues, including HIPAA covered entities; 
agencies of State, territorial, and tribal governments; law enforcement 
officials; individuals; and consumer advocates and groups. We are 
particularly interested in specific examples of situations in which 
reporting to the NICS is hindered by HIPAA requirements, or where there 
may be uncertainty about how HIPAA applies to such reporting, and any 
other concerns about the disclosure of information for these purposes 
by health care entities that both perform the adjudications or 
involuntary commitments and provide the mental health treatment to the 
individuals. We ask that commenters indicate throughout their submitted 
comments which question(s) they are responding to.

II. Questions

    In a 2012 report on implementation of the NIAA, the GAO wrote that 
States had increased reporting to the NICS of the identities of 
individuals who are prohibited from purchasing firearms because they 
have been involuntarily committed to a mental institution, found 
incompetent to stand trial or not guilty by reason of insanity, or 
otherwise adjudicated as having a serious mental condition that results 
in the individuals posing a danger to themselves or others or being 
unable to manage their own affairs.\17\ Specifically, reporting of this 
information grew from 126,000 records in October 2004, to

[[Page 23876]]

approximately 1.2 million in October 2011. The GAO also indicated that 
just 12 states were responsible for the majority of this increase, 
having reported the identities of at least 10,000 individuals who are 
subject to the mental health prohibitor by 2011.\18\ As of February 
2013, the number of records was over 2.7 million.\19\ Despite 
improvements in reporting, only a small proportion of the records of 
individuals who are subject to the mental health prohibitor have been 
reported to the NICS. We invite comment on the following questions 
relating to States' participation in NICS reporting and other related 
issues.
---------------------------------------------------------------------------

    \17\ GAO-12-684, p. 9.
    \18\ GAO-12-684, p. 10.
    \19\ FBI, Active Records in the NICS Index as of February 28, 
2013, http://www.fbi.gov/about-us/cjis/nics/reports/20130205_nics-index.pdf.
---------------------------------------------------------------------------

    1. Does your State routinely report the identities of individuals 
who are subject to the Federal mental health prohibitor to the NICS?
    2. If your State does not routinely report the identities of such 
individuals to the NICS, what are the primary reasons for not doing so?
    a. To what extent, if any, is the HIPAA Privacy Rule perceived as a 
barrier to your participation? If HIPAA is seen as a barrier, please 
specify in what way(s) HIPAA may prevent NICS reporting or make 
reporting difficult. (For example, does HIPAA pose a barrier with 
respect to only certain types of adjudications?)
    b. Are there other legal barriers (e.g., State law)?
    3. If your State does routinely report the identities of such 
individuals to the NICS, did you have to overcome any obstacles to your 
reporting? How did your State overcome those obstacles?
    a. If the HIPAA Privacy Rule was perceived as a barrier to your 
participation, what did you do to meet HIPAA requirements?
    b. If State privacy laws were perceived as a barrier to your 
participation, what did you do to meet State requirements?
    c. Please describe any statutory or regulatory changes adopted by 
your State. To what extent do any changes in State law address the 
requirements of Federal and/or State privacy laws?
    We understand that some States may have designated a particular 
State agency or other entity to collect and maintain NICS information 
and report to the NICS on a regular basis. We request comments on the 
following related questions.
    4. Has your State designated one or more agencies as State 
repositories for information about the identities of individuals who 
are subject to the mental health prohibitor? If so, please identify the 
agencies and specify, for each such agency, whether it is a HIPAA 
covered entity.
    5. If HIPAA applies to the repository, how has your State addressed 
HIPAA requirements while fulfilling its NICS reporting function (e.g., 
do you have a State law that requires reporting, or has your State 
created a hybrid entity to isolate the reporting function from the 
health care component of the repository agency)?
    6. If the HIPAA Privacy Rule were to be amended to expressly permit 
disclosures of the identities of individuals covered by the mental 
health prohibitor to the NICS Index, would you still face any barriers 
to reporting? If so, what are they?
    As discussed above, in many cases, information on the identities of 
persons who are subject to the mental health prohibitor originates with 
entities outside the health care sector that are not subject to HIPAA. 
Still, we recognize that authority to make these determinations is a 
matter of State law and, therefore, the process may vary from State to 
State. Thus, there may be instances in which these types of 
adjudications are made by State agencies or private parties within the 
health care system. We request comments on the following matters.
    7. Are there situations in your State in which a HIPAA covered 
entity (e.g., a physician, a hospital, or another entity in the health 
care system), or a component of a larger organization that is a covered 
entity (e.g., a State health department), has legal authority to 
involuntarily commit a person to a mental institution--without review 
or a final action being made by a court? If so, what types of 
involuntary commitments can be ordered by these authorities?
    8. Are there situations in your State in which a HIPAA covered 
entity (e.g., a physician, a hospital, or another entity in the health 
care system), or a component of a larger organization that is a covered 
entity (e.g., a State health department), has legal authority to make a 
formal adjudication that an individual has a serious mental condition 
that results in a finding of danger to self or others or an inability 
to manage affairs--without review or a final action being made by a 
court? If so, what types of adjudications can be made by these 
authorities?
    9. If HIPAA applies to the entity conducting the relevant mental 
health adjudications, how has your State addressed HIPAA requirements 
while fulfilling its NICS reporting function (e.g., do you have a State 
law that requires reporting, or has your State created a hybrid entity 
to isolate the reporting function from the health care component of the 
repository agency)?
    10. If the HIPAA Privacy Rule were to be amended to expressly 
permit disclosures of the identities of individuals covered by the 
mental health prohibitor to the NICS, would you still face any barriers 
to reporting? If so, what are they?
    As the Federal government works to improve reporting to the NICS to 
ensure comprehensive background checks for firearms purchases, HHS also 
must continue to fulfill its mandate to protect individuals' health 
information privacy rights. Therefore, we request public input on the 
following issues and any other relevant considerations.
    11. Are there privacy protections in place, under State law or 
otherwise, for data collected by State entities for reporting to the 
NICS? Would any State public records laws apply to make this data 
publicly available, or prohibit the reporting to the NICS?
    12. We recognize a heightened need for confidentiality because of 
the sensitivity of, and the stigma attached to, mental health 
conditions. Are there implications for the mental health community, or 
for the treatment/care of consumers of mental health services, in 
having the identities of individuals who are subject to the mental 
health prohibitor reported for NICS purposes by health care entities 
that perform both adjudication and treatment functions? If so, what are 
those implications?
    13. Are there ways that HHS may address or mitigate any unintended 
adverse consequences, for individuals seeking needed mental health 
services, that may be caused by creating express regulatory permission 
to report relevant information to the NICS?
    14. How can HHS better disseminate information to States on HIPAA 
Privacy Rule policies as they relate to NICS reporting? Are there 
central points of contact at the State level that are able to receive 
and share this information with entities that serve in an adjudicatory 
or repository capacity?
    15. Are there any additional guidance materials and/or training 
from HHS on particular aspects of the Privacy Rule that would be 
helpful to address any confusion regarding HIPAA requirements and help 
improve NICS reporting?

    Dated: April 16, 2013.
Leon Rodriguez,
Director, Office for Civil Rights.
[FR Doc. 2013-09602 Filed 4-19-13; 4:15 pm]
BILLING CODE 4153-01-P