Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the National Instant Criminal Background Check System (NICS), 382-396 [2015-33181]
Download as PDF
<![CDATA[
382
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
Air Emissions Standards of
Performance for New Sewage Sludge
Incinerators
§ 62.6917 Identification of plan—negative
declaration.
Letter from the Nebraska Department
of Environmental Quality received
December 6, 2012, certifying that there
are no Sewage Sludge Incinerator units
subject to 40 CFR part 60, subpart
MMMM.
[FR Doc. 2015–33292 Filed 1–5–16; 8:45 am]
BILLING CODE 6560–50–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
45 CFR Part 164
Health Insurance Portability and
Accountability Act (HIPAA) Privacy
Rule and the National Instant Criminal
Background Check System (NICS)
Office for Civil Rights,
Department of Health and Human
Services.
ACTION: Final rule.
AGENCY:
The Department of Health and
Human Services (HHS or ‘‘the
Department’’) is issuing this final rule to
modify the Health Insurance Portability
and Accountability Act of 1996 (HIPAA)
Privacy Rule to expressly permit certain
HIPAA covered entities to disclose to
the National Instant Criminal
Background Check System (NICS) the
identities of individuals who are subject
to a Federal ‘‘mental health prohibitor’’
that disqualifies them from shipping,
transporting, possessing, or receiving a
firearm. The NICS is a national system
maintained by the Federal Bureau of
Investigation (FBI) to conduct
background checks on persons who may
be disqualified from receiving firearms
based on Federally prohibited categories
or State law. Among the persons subject
to the Federal mental health prohibitor
established under the Gun Control Act
of 1968 and implementing regulations
issued by the Department of Justice
(DOJ) are individuals who have been
involuntarily committed to a mental
institution; found incompetent to stand
trial or not guilty by reason of insanity;
or otherwise have been determined by a
court, board, commission, or other
lawful authority to be a danger to
themselves or others or to lack the
mental capacity to contract or manage
their own affairs, as a result of marked
subnormal intelligence or mental
illness, incompetency, condition, or
wgreen on DSK2VPTVN1PROD with RULES
SUMMARY:
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
disease. Under this final rule, only
covered entities with lawful authority to
make the adjudications or commitment
decisions that make individuals subject
to the Federal mental health prohibitor,
or that serve as repositories of
information for NICS reporting
purposes, are permitted to disclose the
information needed for these purposes.
The disclosure is restricted to limited
demographic and certain other
information needed for NICS purposes.
The rule specifically prohibits the
disclosure of diagnostic or clinical
information, from medical records or
other sources, and any mental health
information beyond the indication that
the individual is subject to the Federal
mental health prohibitor.
DATES: Effective date: This final rule is
effective on February 5, 2016.
FOR FURTHER INFORMATION CONTACT:
Andra Wicks, 202–205–2292.
SUPPLEMENTARY INFORMATION:
I. Background
On January 16, 2013, President Barack
Obama announced 23 executive actions
aimed at curbing gun violence across
the nation. Those actions include efforts
by the Federal government to strengthen
the national background check system,
and a specific commitment to ‘‘[a]ddress
unnecessary legal barriers, particularly
relating to the Health Insurance
Portability and Accountability Act, that
may prevent States from making
information available to the background
check system.’’ The National Instant
Criminal Background Check System
(NICS) is the system used to determine
whether a potential firearms recipient is
statutorily prohibited from possessing or
receiving a firearm. The Department
proposed, and now finalizes, a
modification to the HIPAA Privacy Rule
to permit certain covered entities to
disclose to the NICS the identities of
persons who are not allowed to possess
or receive a firearm because they are
subject to the Federal mental health
prohibitor.
The National Instant Criminal
Background Check System (NICS)
The Brady Handgun Violence
Prevention Act of 1993, Public Law
103–159 (Brady Gun Law), and its
implementing regulations, are designed
to prevent the transfer of firearms by
licensed dealers to individuals who are
not allowed to possess or receive them
as a result of restrictions contained in
either the Gun Control Act of 1968, as
amended (Title 18, United States Code,
Chapter 44), or State law. The Gun
Control Act identifies several categories
(known as ‘‘prohibitors’’) of
PO 00000
Frm 00012
Fmt 4700
Sfmt 4700
individuals 1 who are prohibited from
engaging in the shipment, transport,
receipt, or possession of firearms,
including convicted felons and
fugitives. Most relevant for the purposes
of this rule is the Federal mental health
prohibitor, which, pursuant to
Department of Justice (DOJ) regulations,
applies to individuals who have been
involuntarily committed to a mental
institution, for reasons such as mental
illness or drug use; 2 found incompetent
to stand trial or not guilty by reason of
insanity; or otherwise determined by a
court, board, commission, or other
lawful authority to be a danger to
themselves or others or unable to
manage their own affairs, as a result of
marked subnormal intelligence, or
mental illness, incompetency,
condition, or disease.3 4
The Brady Gun Law established the
NICS to help enforce these prohibitions,
as well as State law prohibitions on the
possession or receipt of firearms.5 The
NICS Index, a database administered by
the Federal Bureau of Investigation
(FBI), collects and maintains certain
identifying information about
individuals who are subject to one or
more Federal prohibitors and thus who
are ineligible to purchase firearms. As of
2012, the NICS Index also contains
information on persons who are subject
to State law prohibitions on the
possession or receipt of firearms.6 The
1 See 18 U.S.C. 922(g) and (n) and implementing
regulations at 27 CFR 478.11 and 27 CFR 478.32.
2 The regulation, at 27 CFR 478.11, defines
‘‘Committed to a mental institution’’ as a formal
commitment to the institution by a court or other
lawful authority. The term does not apply to a
person voluntarily admitted to a mental institution
or in a mental institution merely for observation.
3 The term used in the statute is ‘‘adjudicated as
a mental defective. The term includes a finding of
insanity in a criminal case, and a finding of
incompetence to stand trial or a finding of not
guilty by reason of lack of mental responsibility
pursuant to the Uniform Code of Military Justice.
27 CFR 478.11.
4 This rule refers to the involuntary commitments
and other applicable adjudications as, collectively,
‘‘adjudications that make an individual subject to
the Federal mental health prohibitor.’’
5 See Public Law 103–159, 18 U.S.C. 921–925,
and implementing regulations at 28 CFR 25.1
through 25.11 (establishing NICS information
system specifications and processes) and 27 CFR
part 478 (establishing requirements and
prohibitions for commerce in firearms and
ammunition, including requirements related to
conducting NICS background checks); and 42
U.S.C. 3759(b) (allocating a percentage of certain
DOJ funds for State reporting of NICS data).
6 See Statement Before the Senate Judiciary
Committee, Subcommittee on Crime and Terrorism
at a hearing entitled, ‘‘THE FIX GUN CHECKS ACT:
BETTER STATE AND FEDERAL COMPLIANCE,
SMARTER ENFORCEMENT’’ (November 15, 2011),
by David Cuthbertson, Assistant Director, Criminal
Justice Information Services Division, Federal
Bureau of Investigation. Testimony available at:
https://www.justice.gov/ola/testimony/112-1/11-1511-fbi-cuthbertson-testimony-re-the-fix-gun-checks-
E:\FR\FM\06JAR1.SGM
06JAR1
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
wgreen on DSK2VPTVN1PROD with RULES
minimum information required in a
NICS Index record consists of: The
name of the ineligible individual; the
date of birth; sex; and codes indicating
the applicable prohibitor, the submitting
entity, and the agency record supporting
the prohibition (e.g., an order for
involuntary commitment). For
individuals subject to the Federal
mental health prohibitor, only the fact
that the individual is subject to that
prohibitor is submitted to the NICS;
underlying diagnoses, treatment
records, and other identifiable health
information are not provided to or
maintained by the NICS. A NICS
background check queries the NICS
Index and certain other national
databases 7 to determine whether a
prospective buyer’s identifying
information matches any prohibiting
records contained in the databases. The
NICS Index can be accessed only for the
limited purposes authorized by
regulation (see 28 CFR 25.6(j)) and
cannot be used for other purposes,
including general law enforcement
activities.
The potential transfer of a firearm
from a Federal Firearms Licensee (FFL)
to a prospective buyer proceeds as
follows: First, the prospective buyer is
required to provide personal
information on a Firearms Transaction
Record (ATF Form 4473). Unless the
prospective buyer has documentation
that he or she qualifies for an exception
to the NICS background check
requirement under 18 U.S.C. 922(t)(3),8
the FFL contacts the NICS—
electronically, by telephone, or through
a State level point of contact—and
provides certain identifying information
about the prospective buyer from ATF
Form 4473.9
The FFL then receives a response that
the prospective firearm transfer may
act.pdf. We note also that State law may be more
restrictive than Federal law in some cases.
7 The other databases include the Interstate
Identification Index, which contains criminal
history record information; and the National Crime
Information Center, which includes, e.g.,
information on persons subject to civil protection
orders and arrest warrants. Additional information
is available at, https://www.fbi.gov/about-us/cjis/
nics/general-information/nics-overview.
8 These exceptions are listed in the Bureau of
Alcohol, Tobacco, Firearms and Explosives (ATF)
regulation at 27 CFR 478.102(d). For example, a
NICS check would not be required where the
potential recipient of a firearm has presented a
valid State permit or license, provided conditions
at 27 CFR 478.102(d)(1) are met.
9 The form collects the prospective buyer’s name;
demographic information such as address, place
and date of birth, gender, citizenship, race and
ethnicity; and ‘‘yes’’ or ‘‘no’’ answers to questions
about the person’s criminal history and other
potential prohibitors. The form is available at
https://www.atf.gov/forms/download/atf-f-44731.pdf.
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
proceed or is delayed. The transfer is
delayed if the prospective buyer’s
information matches a record contained
in one of the databases reviewed. If
there is a match, a NICS examiner
reviews the record to determine whether
the information it contains is, in fact,
prohibiting, and then either: (1) If the
record does not contain prohibiting
information, advises the FFL to proceed
with the transaction; (2) if the record
does contain prohibiting information,
denies the transaction (due to
ineligibility); or (3) if it is unclear based
solely on the existing information in the
record whether it is prohibiting, delays
the transaction pending further
research.10 The NICS examiner does not
disclose the reason for the
determination to the FFL (e.g., the FFL
would not learn that the individual was
ineligible due to the Federal mental
health prohibitor). In case of a delay, if
the NICS examiner does not provide a
final instruction to the FFL within three
business days of the initial background
check request, the FFL may proceed
with the transaction.11
Although FFLs are required in most
cases to request a background check
through the NICS before transferring a
firearm to a prospective buyer,12 Federal
law does not require State agencies to
report to the NICS the identities of
individuals who are prohibited from
purchasing firearms under either
Federal or State prohibitors, and not all
States report complete information to
the NICS or the databases checked by it.
Following the shooting at Virginia Tech
University in 2007, and other tragedies
involving the illegal use of firearms,
Congress enacted the NICS
Improvement Amendments Act (NIAA)
of 2007, Public Law 110–180. Among
other provisions, the NIAA requires
Federal agencies to make accessible to
the NICS the identities of individuals
known by the agencies to be subject to
one or more prohibitors, and it
authorizes incentive grants for States to
provide such information when it is in
their possession.13 In addition, some
10 For example, a ‘‘delay’’ response may mean
that further research is required because potentially
prohibitive criteria exist, but the matched records
are incomplete, See Federal Bureau of Investigation
(FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/
general-information/fact-sheet.
11 Some States have waiting periods that also
must be complied with before a firearm may be
transferred, regardless of whether a proceed
response from NICS is received by the FFL within
three business days.
12 See 27 CFR 478.102. Exceptions to this
requirement are referenced in FN 8 above, and
listed in the regulation at 27 CFR 478.102(d).
13 Eligibility for these grants is limited to States
that have implemented a ‘‘relief from disabilities’’
program for individuals who are prohibited from
possessing or receiving firearms for mental health
PO 00000
Frm 00013
Fmt 4700
Sfmt 4700
383
States have enacted legislation requiring
the reporting of the identities of
ineligible individuals to databases
accessible to the NICS or to a State level
repository responsible for submitting
information to the relevant databases.
States generally report criminal
history information to the other relevant
databases that are checked by the NICS;
however, many States continue to report
little if any information concerning
individuals subject to the Federal
mental health prohibitor (or the other
Federal prohibitors) to the NICS
Index.14 As a result, the NICS does not
have access to complete information
about all individuals who are subject to
one or more of the Federal prohibited
categories or who are prohibited from
possessing or receiving firearms under
State law.
The HIPAA Privacy Rule and NICS
Reporting
The Privacy Rule, promulgated under
the Health Insurance Portability and
Accountability Act of 1996 (HIPAA),
Title II, Subtitle F—Administrative
Simplification, Public Law 104–191,
establishes federal protections to ensure
the privacy and security of protected
health information (PHI) and establishes
an array of individual rights with
respect to one’s own health information.
HIPAA applies to covered entities,
which include health plans, health care
clearinghouses, and health care
providers that conduct certain standard
transactions (such as billing insurance)
electronically. HIPAA covered entities
may only use and disclose PHI with the
individual’s written authorization, or as
otherwise expressly permitted or
required by the HIPAA Privacy Rule.
The Privacy Rule seeks to balance
individuals’ privacy interests with
important public policy goals including
public health and safety. In doing so,
the Privacy Rule allows, subject to
certain conditions and limitations, uses
and disclosures of PHI without
individuals’ authorization for certain
law enforcement purposes, to avert a
serious threat to health or safety, and
where required by State or other law,
among other purposes.15
reasons. Such programs must provide that a State
court, board, commission, or other lawful authority
shall grant the relief if, based on the circumstances
regarding the disabilities and the person’s record
and reputation, the person is not likely to pose a
danger to public safety, and granting the relief
would not be contrary to the public interest. See
Public Law 110–180, Section 105.
14 Federal law does not require States to submit
reports to any of the three databases (the NICS
Index, the III, and NCIC) accessed during a NICS
Check.
15 See 45 CFR 164.512.
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
384
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
As stated above, individuals who are
subject to the Federal mental health
prohibitor are ineligible to purchase a
firearm because they have been
‘‘committed to a mental institution’’ or
‘‘adjudicated as a mental defective.’’ 16
DOJ regulations define these categories
to include persons who have been
involuntarily committed to a mental
institution for reasons such as mental
illness or drug use; have been found
incompetent to stand trial or not guilty
by reason of insanity; or otherwise have
been determined by a court, board,
commission, or other lawful authority to
be a danger to themselves or others or
unable to manage their own affairs, as
a result of marked subnormal
intelligence, or mental illness,
incompetency, condition, or disease. In
many cases, these records are not
subject to HIPAA. Records of
individuals adjudicated as incompetent
to stand trial, or not guilty by reason of
insanity, originate with entities in the
criminal justice system, and these
entities are not HIPAA covered entities.
Likewise, involuntary civil
commitments usually are made by court
order, and thus, records of such formal
commitments typically originate with
entities in the justice system. In
addition, many adjudications
determining that individuals are a
danger to themselves or others, or are
incapable of managing their own affairs,
occur through a legal process in the
court system.
However, because of the variety of
State laws, there may be State agencies,
boards, commissions, or other lawful
authorities outside the court system that
are involved in some involuntary
commitments or mental health
adjudications that make an individual
subject to the Federal mental health
prohibitor. Moreover, we understand
that some States have designated
repositories to collect and report to the
NICS the identities of individuals
subject to the Federal mental health
prohibitor. We believe that certain of
these lawful authorities or repositories
also may be HIPAA covered entities
(e.g., a State health agency may be a
covered entity).
As we described in the NPRM, where
the record of an involuntary
commitment or mental health
adjudication originates with a HIPAA
covered entity, or the HIPAA covered
entity is the State repository for such
records, there are two ways in which
covered entities can currently report to
the NICS (without the individual’s
authorization). First, a covered entity
can disclose the relevant information to
16 See
18 U.S.C. 922(g)(4).
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
the NICS where a State has enacted a
law that requires (and does not merely
authorize) such reporting.17 Second,
where a State has not enacted such a
law, a HIPAA covered entity that
performs both health care and nonhealth care functions (e.g., NICS
reporting) could become a hybrid entity
under HIPAA so that the Privacy Rule
applies only to its health care functions.
A covered entity can achieve hybrid
entity status by designating its health
care components as separate from other
components, documenting the
designation, and implementing policies
and procedures to prevent unauthorized
access to PHI by the entity’s noncovered components.18 Under these
circumstances, the covered entity can
report prohibitor information through
its non-HIPAA covered NICS reporting
unit without restriction under the
Privacy Rule. These provisions remain
in effect and are not altered by the
amendments to the Privacy Rule that we
issue today.
However, despite these avenues for
disclosure, many States still were not
reporting to the NICS essential
information on persons prohibited from
possessing firearms for reasons related
to mental health; concerns were raised
that the HIPAA Privacy Rule’s
restrictions on covered entities’
disclosures of PHI might be preventing
certain States from reporting the
relevant information to the NICS.
In addition, in July 2012, the U.S.
Government Accountability Office
(GAO) reported to Congress on the
results of a survey of six States that it
had assessed as part of a performance
audit of the progress made by DOJ and
the States in implementing the NIAA.19
In the report, the GAO wrote that
‘‘officials from 3 of the 6 States we
reviewed said that the absence of
explicit State-level statutory authority to
share mental health records was an
impediment to making such records
available to NICS.’’ 20 The report also
17 See 45 CFR 164.512(a). Note that disclosures
for NICS purposes would not fall under the Privacy
Rule’s provisions permitting disclosures for law
enforcement purposes (which apply to specific law
enforcement inquiries) or to avert a serious threat
to health or safety (which require an imminent
threat of harm). See 45 CFR 164.512(f) and (j).
18 See 45 CFR 164.103, 164.105; 67 FR 53182 (8/
14/2002).
19 See GAO–12–684, Gun Control: Sharing
Promising Practices and Assessing Incentives Could
Better Position Justice to Assist States in Providing
Records for Background Checks.
20 We note that the GAO Report uses the term
‘‘mental health records’’ to refer to identifying
information on individuals who are subject to the
Federal mental health prohibitor. To avoid
implying that mental health records are collected by
NICS, the Department uses the terms ‘‘identities,’’
‘‘information,’’ or ‘‘data’’ in place of ‘‘mental health
records.’’ GAO–12–684, p. 12.
PO 00000
Frm 00014
Fmt 4700
Sfmt 4700
stated that, although the number of
records provided by the States to the
NICS had increased by 800 percent
between 2004 and 2011, this increase
was largely due to efforts by only 12
States. The report raised the possibility
that States that do not report to the NICS
the identities of individuals who are
prohibited from possessing firearms for
reasons related to mental health may
experience challenges to reporting
related to the HIPAA Privacy Rule.
II. The ANPRM
Background
On April 23, 2013, the Department
published an Advance Notice of
Proposed Rulemaking (ANPRM)
requesting public input on these issues
(78 FR 23872). The ANPRM explained
that the Department was considering
creating an express permission in the
HIPAA Privacy Rule for reporting
information relevant to the Federal
mental health prohibitor to the NICS by
those HIPAA covered entities that (a)
are responsible for the involuntary
commitments or other adjudications
that make individuals subject to the
Federal mental health prohibitor, or (b)
are designated by a State to report to the
NICS. In the ANPRM, the Department
indicated that such an amendment
might produce clarity regarding the
Privacy Rule and help make it simpler
for States to report the identities of such
individuals to the NICS.
To inform our efforts to address any
issues in this area, we requested
comments on a series of questions
concerning the nature and scope of the
problem of underreporting and whether
a modification to the Privacy Rule
would help address these issues. We
also requested comments on any
implications of a modification to the
Privacy Rule for the mental health
community or for the treatment of
individuals, and how the Department
might address any unintended
consequences of such a modification.
We received over 2,050 comments in
response from individuals, State
agencies, health care providers,
associations of health care professionals,
consumer advocacy groups, and other
stakeholders.
A number of commenters supported
creating an express permission as a way
to remove a potential barrier to an
important and necessary public safety
measure, which could help keep
firearms out of the hands of individuals
who should not have them by
strengthening the background check
system. Many others generally
expressed concern that the NICS, the
Federal mental health prohibitor, and
E:\FR\FM\06JAR1.SGM
06JAR1
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
the contemplated HIPAA permission
would infringe on their Second
Amendment right to bear arms and the
right to be afforded due process of law
under the U.S. Constitution. In addition,
many individual commenters, as well as
health care providers, organizations
representing providers, and consumer
advocacy groups, emphasized the
importance of protecting individuals’
health information privacy. These
commenters raised concerns regarding
the possible adverse consequences an
express permission to report certain
information could have on the patientprovider treatment relationship and
individuals’ willingness to seek needed
mental health care.21
wgreen on DSK2VPTVN1PROD with RULES
III. Summary of the NPRM
After considering the public
comments received on the ANPRM, we
published a Notice of Proposed
Rulemaking (NPRM) on January 7,
2014,22 proposing to use the
Department’s broad authority under
HIPAA to specify the permitted uses
and disclosures of PHI by HIPAA
covered entities. The NPRM proposed to
revise 45 CFR 164.512 of the Privacy
Rule by adding a new category of
permitted disclosures to 45 CFR
164.512(k), which addresses uses and
disclosures for specialized government
functions. The NPRM proposed new
provisions at (k)(7) that would permit
certain covered entities to disclose the
limited demographic and certain other
information needed for NICS reporting
purposes.
We indicated in the NPRM that there
is a strong public safety need for this
information to be accessible to the NICS
and that some States are currently
under-reporting or not reporting this
information at all. Further, although
most of the information relevant to the
Federal mental health prohibitor is held
by entities that are not covered by
HIPAA, for those few HIPAA covered
entities that may be involved in the
relevant commitments or adjudications,
the Privacy Rule’s existing paths for
disclosure did not appear to be
sufficient. We explained that, to the
extent that some covered entities
perform adjudicatory or repository
functions in States that have not enacted
laws requiring reporting to the NICS,
and that a subset of those may be unable
to achieve hybrid entity status due to
administrative challenges or other
reasons, an express permission would
21 Please see the ANPRM for a more thorough
discussion of public comments and responses. 78
FR 23872 (April 23, 2013).
22 See 79 FR 784 (January 7, 2014).
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
provide clarity and remove a barrier to
their reporting.
However, to address concerns
regarding an express permission’s
potential to harm the patient-provider
relationship or deterring individuals
from seeking needed mental health care,
we proposed to narrowly tailor the
permission to report information on
individuals subject to the Federal
mental health prohibitor in a number of
ways. Specifically, we proposed to
limit: (1) Which covered entities could
use or disclose PHI for NICS reporting
purposes, (2) to whom the PHI could be
disclosed, and (3) the scope of the
information that could be used or
disclosed.
First, the NPRM proposed a new
paragraph at 164.512(k)(7)(i) to permit
certain NICS disclosures only by those
covered entities that function as
repositories of information relevant to
the Federal mental health prohibitor on
behalf of a State or that are responsible
for ordering the involuntary
commitments or other adjudications
that make an individual subject to the
Federal mental health prohibitor. The
Federal prohibitor regulations define an
involuntary commitment as a formal
commitment of a person to a mental
institution by a court, board,
commission, or other lawful authority.
The other applicable adjudications
include determinations by a court,
board, commission, or other lawful
authority that persons are a danger to
themselves or others, or lack the mental
capacity to contract or manage their
own affairs, as a result of marked
subnormal intelligence, or mental
illness, incompetency, condition, or
disease.23 The prohibitor does not apply
to individuals in a psychiatric facility
for observation or who have been
admitted voluntarily; thus, the proposed
rule would not have permitted
disclosures with respect to those
individuals.
With respect to repositories of Federal
mental health prohibitor information,
we explained further that we did not
intend to require States to formally
designate the entities responsible for
NICS reporting, but that we would
expect States to be able to identify the
relevant entities.
We noted in the NPRM that our
understanding was that lawful authority
for performing such adjudications and
repository functions rests, for the most
part, with entities that operate outside
the scope of HIPAA. However, in the
interest of public safety, we wanted to
ensure that relevant adjudications could
be reported in the subset of States in
23 See
PO 00000
27 CFR 478.11 (Definitions).
Frm 00015
Fmt 4700
Sfmt 4700
385
which HIPAA covered entities may
make, or collect and report records of,
these determinations.
We explained further that, in
permitting only entities involved in
these adjudicatory or repository/
reporting functions to use or disclose
Federal mental health prohibitor
information for NICS purposes, the
proposal would not create a permission
for most treating providers to disclose
PHI about their own patients for these
purposes. We agreed with the
commenters on the ANPRM who argued
that encouraging voluntary treatment is
critical to ensuring positive outcomes
for individuals’ health as well as the
public’s safety, and explained that the
NPRM was designed to balance that goal
and the public safety interests served by
the NICS. We also agreed that nonhealth care entities bear primary
responsibility for collection and
reporting of information relevant to the
Federal mental health prohibitor in
most States. However, where a HIPAA
covered entity is a board, commission,
or other lawful authority that makes
involuntary commitments or other
adjudications that result in individuals
being subject to the Federal mental
health prohibitor, we believed those
entities too were likely to hold records
of the relevant commitments and
adjudications.
We requested public comment on the
extent to which some States may have
vested responsibility for Federal mental
health prohibitor reporting in HIPAA
covered entities, to what extent records
needed for NICS reporting are created or
maintained by covered entities, and
whether there are circumstances in
which health care providers would need
to report the identity of an individual
subject to the Federal mental health
prohibitor to a State designated records
repository or directly to the NICS. We
also requested comment on the types of
additional guidance from OCR and/or
the NICS that would be helpful for
understanding to which covered
entities, and under what circumstances,
the proposed permission would apply.
Second, we proposed a new
paragraph at (k)(7)(ii) providing that a
covered entity identified in (k)(7)(i) may
use or disclose Federal mental health
prohibitor information for NICS
purposes only directly to the NICS or to
an entity designated by the State as a
repository of data for purposes of
reporting to the NICS. By clearly
delimiting the permitted recipients of
such disclosures, we explained that the
rule would ensure that covered entities
do not exceed the intended scope of the
permission by disclosing information
relevant to the Federal mental health
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
386
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
prohibitor to, for example, law
enforcement agencies that do not
operate as repositories of data for
purposes of reporting to the NICS.24 We
requested comment on whether there
are States in which a type of entity not
described in this proposed paragraph is
responsible for NICS reporting and thus,
should be able to receive NICS data
from a HIPAA covered entity.
Third, we proposed a new paragraph
at (k)(7)(iii) to limit the information
permitted to be used or disclosed to
what is needed for purposes of reporting
to the NICS. This is consistent with the
Privacy Rule provision that generally
requires covered entities to make
reasonable efforts to limit the PHI used
or disclosed to the minimum necessary
to accomplish the intended purpose.
Specifically, in the proposed regulation
text, we made clear that only the limited
demographic and certain other
information needed for purposes of
reporting to the NICS could be reported
under the permission. We indicated
that, at the time, we believed that the
necessary information would be the data
elements needed to create a NICS Index
record: (1) Name of the individual; (2)
date of birth; (3) sex; (4) a code or
notation indicating that the individual
is subject to the Federal mental health
prohibitor; (5) a code or notation
representing the reporting entity; and (6)
a code identifying the agency record
supporting the prohibition. The
proposed regulation text expressly
provided that the proposed modification
would not permit the use or disclosure
of clinical or diagnostic information for
NICS reporting purposes. We requested
comment on whether, and in what
circumstances, HIPAA covered entities
or other entities, such as courts,
currently report to a records repository
or directly to the NICS information that
was not listed in the proposed
paragraph.
In addition, we explained that we
were also considering permitting the
disclosure of some or all the following
additional data elements, which are
optional fields for a NICS Index entry,
for NICS reporting purposes: Social
Security number, place of birth, State of
residence, height, weight, eye color, hair
color, and race. As we noted in the
NPRM, from what we understand, these
elements are not included in every NICS
record, but often are used to confirm
that a prospective firearm recipient
matches a record searched by the NICS
or to eliminate ‘‘false positive’’
24 We did not propose to change the Privacy
Rule’s existing permissions to use or disclose PHI
for specific law enforcement investigations, as
provided in 45 CFR 164.512(f).
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
background check results. We requested
public comment on this issue.
We also proposed to limit the
permission to uses and disclosures
about individuals who are subject to the
Federal mental health prohibitor and
not to apply it to disclosures about
individuals subject only to State mental
health prohibitors. However, we
requested comment on this aspect of the
scope of the permission, specifically
with regard to whether the permission
should be broadened to allow covered
entities to also disclose the identities of
individuals who are prohibited by State
law from possessing or receiving
firearms for reasons related to mental
health.
Finally, we also explained that the
proposed permission would apply only
with respect to the PHI of individuals
subject to the Federal mental health
prohibitor and not to the PHI of those
persons who may be subject to the other
Federal prohibitors listed at 18 U.S.C.
922(g). The lack of an express HIPAA
permission for reporting information
relevant to the Federal mental health
prohibitor was a limited problem and
we had not heard that there was a
similar issue with respect to the other
prohibitors. Thus, for example, a
covered entity would not be able to use
the proposed permission to use or
disclose information about an
individual who is an unlawful user of
or addicted to any controlled substance
(18 U.S.C. 922(g)(3)), except to the
extent the individual was also subject to
the Federal mental health prohibitor.
We also noted that other laws could
impact disclosures related to the other
Federal prohibitors, including 18 U.S.C.
922(g)(3).25
interests to ensure that individuals are
not discouraged from seeking voluntary
treatment.
Under this final rule, covered entities
that order involuntary commitments or
make other adjudications that subject
individuals to the Federal mental health
prohibitor, or that serve as repositories
of the relevant data, are permitted to use
or disclose the information needed for
NICS reporting of such individuals
either directly to the NICS or to a State
repository of NICS data. Thus, if a
covered health care entity also has a role
in the relevant mental health
adjudications or serves as a State data
repository, it now may disclose the
relevant information for NICS reporting
purposes under this new permission
even if it is not designated as a HIPAA
hybrid entity or required by State law to
report. This final rule does not create an
express permission for covered entities
to disclose for NICS reporting purposes
the PHI of individuals who are subject
to State-only mental health prohibitors.
The Department’s rationale for
adopting the provisions in this final
rule, along with further clarifications
and interpretations of the provisions, is
explained below in the responses to the
public comments on the NPRM.
IV. Provisions of the Final Regulation
This final rule adopts the
modifications to the HIPAA Privacy
Rule as proposed. After considering the
comments we received, we continue to
believe that the creation of a limited
express permission in the HIPAA
Privacy Rule to use or disclose certain
information relevant to the Federal
mental health prohibitor for NICS
purposes is necessary to address barriers
related to HIPAA and to ensure that
relevant information can be reported for
this important public safety purpose.
Furthermore, this narrowly tailored rule
appropriately balances public safety
goals with important patient privacy
A. Comments Regarding Creating an
Express Permission for NICS Reporting
in the HIPAA Privacy Rule
Comments: A number of commenters
expressed general support for including
an express permission in the HIPAA
Privacy Rule for reporting certain
information to the NICS, stating that the
rule change would help increase the
reporting of information to the NICS,
reduce the ability of individuals with
serious mental health problems to
obtain firearms, and ultimately lessen
the risk of harm to the individuals
themselves, law enforcement, and the
public.
Several advocacy organizations
involved in gun violence prevention
agreed with our statements in the NPRM
that the HIPAA Privacy Rule and, in
some cases, perceptions of the Privacy
Rule, may create a barrier to certain
entities reporting to the NICS, and that
the proposed modification would
25 The ability of certain entities to report
individuals who are subject to the Federal
prohibitor at 18 U.S.C. 922(g)(3) may be affected by
the Confidentiality of Alcohol and Drug Abuse
Patient Records Regulations, 42 CFR part 2,
administered by the Substance Abuse and Mental
Health Services Administration (SAMHSA).
PO 00000
Frm 00016
Fmt 4700
Sfmt 4700
V. Analysis of and Responses to Public
Comments
We received more than 430 public
comments in response to the NPRM,
including from advocacy organizations,
associations of health care and mental
health professionals, a state mental
health agency, and individual members
of the public. A summary of the
comments we received on the proposed
rule and our responses follow.
E:\FR\FM\06JAR1.SGM
06JAR1
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
wgreen on DSK2VPTVN1PROD with RULES
address this problem. For example, the
comment submitted by Mayors Against
Illegal Guns (MAIG) indicated that
mental health treatment facilities in
seven States currently are required by
State law to report Federal mental
health prohibitor information either
directly to the NICS or to State agencies
that report to the NICS, which indicates
that mental health facilities do in some
cases hold the relevant records. MAIG
inferred from this information that there
likely are other States in which HIPAA
covered entities have information that
should be reported to the NICS, but that
the entities may not be reporting due to
concerns about the HIPAA Privacy
Rule’s restrictions on disclosures. MAIG
also cited statements from interviews its
researchers conducted with State
officials about issues related to NICS
reporting and noted that officials from
nine States and the District of Columbia
had expressed concern that HIPAA, or
other privacy requirements, generally
prohibited sending records to the NICS,
and thus that reporting would violate
such requirements. MAIG asserted that
whether these cited concerns were
based on real or perceived barriers, its
research indicated that making clear the
ability to report without violating
privacy laws tended to greatly improve
state reporting rates, and that the
proposed modifications to the Privacy
Rule similarly would help states
improve their record submissions.26
A number of commenters asserted
that increasing reporting to the NICS
could, in turn, help to decrease rates of
gun violence. One of these commenters
cited research indicating that, in one
State, having a mental health
adjudication record in the NICS
database appeared to reduce the chance
of a person committing a first violent
crime.27
In addition, a number of commenters,
including the American Medical
Association (AMA), and the American
26 MAIG, Fatal Gaps, How Missing Records in the
Federal Background Check System Put Guns in the
Hands of Killers (Nov. 2011).
27 The commenter cited Jeffrey Swanson,
Preventing Gun Violence Involving People with
Serious Mental Illness in REDUCING GUN
VIOLENCE IN AMERICA, INFORMING POLICY
WITH EVIDENCE AND ANALYSIS (eds. Daniel W.
Webster and Jon S. Vernick, 2013). The study
authors note that, ‘‘[c]onsidering separately the
subgroup of people with serious mental illness who
do not have criminal records, our data seem to
suggest that the Brady Law background checks can
have some positive effect, if enforced. In those with
a gun-disqualifying mental health record, risk of
violent criminal offending declined significantly
after Connecticut began reporting gun-disqualifying
mental health records to the NICS.’’ The authors
also describe the limitations of the study and add,
‘‘[t]hese findings do not prove a causal relationship
between the background check system and reduced
violent crime.’’
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
Psychiatric Association (APA),
expressed appreciation that the
proposed rule would appropriately
balance protecting public safety and
preserving the patient-physician
relationship by narrowly defining the
scope of the permission. The AMA
stated that its view on the issue of
reporting patient information to the
NICS is governed by the association’s
Code of Medical Ethics and policies
adopted by the AMA’s policy making
body. The AMA indicated that the Code
of Ethics supports strong protections for
patient privacy and, in most cases,
requires physicians to keep patient
medical records strictly confidential. If
there must be a breach in
confidentiality, such as for public health
or safety reasons, the disclosures must
be as narrow in scope as possible. In
light of these considerations, the AMA
expressed support for the Department’s
approach.
In contrast, many commenters did not
support adding an express permission
in the HIPAA Privacy Rule for reporting
certain information about persons
subject to the Federal mental health
prohibitor for NICS purposes. Several
commenters asserted that there are only
‘‘perceived barriers’’ related to HIPAA,
not real ones, so changing HIPAA would
be unlikely to increase the reporting of
mental health prohibitor information for
NICS purposes. One commenter
suggested that, rather than facing
obstacles to reporting, States may be
choosing not to report on certain
categories of prohibited individuals for
reasons unrelated to HIPAA—for
example, because the States do not
believe the individuals pose a danger.
Other comments, some of which
highlighted the importance of early and
appropriate mental health intervention
as the most effective way to prevent
violence related to mental illness,
expressed concern that the proposed
permission would discourage
individuals from seeking needed
treatment. For example, the National
Association of Psychiatric Health
Systems (NAPHS) predicted that the
public perception of the proposed rule
would be that, if an individual disclosed
information to a therapist, the therapist
would be required to ‘‘report’’ the
patient. This commenter argued that, as
a result, the proposed rule would create
a chilling effect on individuals’
willingness to discuss issues in
treatment that could lead to positive
resolution rather than violence directed
toward themselves or others. A number
of commenters also expressed concern
that the proposed rule would unfairly
target persons with mental illness and
perpetuate unfounded and damaging
PO 00000
Frm 00017
Fmt 4700
Sfmt 4700
387
stereotypes about persons with mental
illness by sending a message to the
public that the Department perceives
mental illness as inextricably linked
with violence.
Some commenters expressed general
concern regarding the effects of the
proposed rule on individuals’ privacy
interests. A number of these
commenters argued that
communications between patients and
their health care providers should be
kept confidential under all
circumstances.
Response: After considering the
comments, we continue to believe that
the creation of a limited express
permission in the HIPAA Privacy Rule
to disclose information relevant to the
Federal mental prohibitor for NICS
purposes is necessary to address barriers
to reporting. In particular, to the extent
that some States do not require
reporting by law, and reporting entities
in those States may face administrative
or other challenges in creating a hybrid
entity, the HIPAA Privacy Rule may
create impediments to reporting that
cannot be cured through mere guidance.
Therefore, we believe such an express
permission will serve an important
public safety interest by removing a
barrier to reporting that may exist in
certain circumstances and thereby
potentially increase reporting by States
that historically have reported little or
no Federal mental health prohibitor data
to the NICS due to concerns about
violating the Privacy Rule.
Further, we believe that the
limitations contained in the narrowly
tailored express permission we adopt
appropriately respond to commenters’
important concerns about discouraging
individuals who need mental health
treatment from seeking care. First, we
limit the permission to only those
covered entities that order the
involuntary commitments or make the
other adjudications that cause
individuals to be subject to the Federal
mental health prohibitor, or that serve
as repositories of such information for
NICS reporting purposes. Thus, the rule
does not affect most treating providers
or create a permission for them to
disclose PHI about their own patients
for these purposes. Second, we permit
such entities to disclose NICS data only
to designated repositories or the NICS.
Third, we limit the information that
may be disclosed to certain
demographic or other information that
is necessary for NICS reporting. Finally,
we do not expand the permission to
encompass State law prohibitor
information. These aspects of the
provision are discussed more fully
below. By limiting the permission in
E:\FR\FM\06JAR1.SGM
06JAR1
388
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
these ways, we protect the patientprovider relationship. Further, we
believe these limitations carefully
balance an individual’s privacy interests
with the public safety interest in
reporting certain information to the
NICS.
In response to concerns that the rule
unfairly singles out individuals with
mental illness, we emphasize, as we did
in the proposed rule, that a mental
health diagnosis does not, in itself,
make an individual subject to the
Federal mental health prohibitor, which
requires an involuntary commitment or
adjudication that the individual poses a
danger to self or others or lacks the
mental capacity to contract or manage
his or her own affairs.
In addition, the Department continues
to support efforts by the Administration
to dispel negative attitudes and
misperceptions relating to mental
illness and to encourage individuals to
seek voluntary mental health treatment.
With the implementation of the
Affordable Care Act, millions of
Americans who did not previously have
coverage will receive coverage for
mental health services.
wgreen on DSK2VPTVN1PROD with RULES
B. Comments Regarding the Scope of the
Permission
Expanding to State Law Prohibitors
Comments: We received several
comments in response to our question
about whether the permission should be
expanded to include State law
prohibitors. Of these, a minority of
commenters supported expanding the
proposed rule to permit disclosures of
information about individuals who are
subject to State-only mental health
prohibitors (i.e., State prohibitors that
have different criteria than the Federal
mental health prohibitor). Several
commenters who advocated for the
disclosure of such information for NICS
reporting purposes asserted that State
law prohibitors would be effective only
if accurate and adequate information
were submitted to the NICS. One of
these commenters argued that State
efforts to report disqualifying records to
the NICS should be encouraged, not
curtailed by confusion over the
applicability of the HIPAA Privacy
Rules. The commenter also argued that
it would create greater confusion not to
include the same express permission
with respect to State mental health
prohibitor information as was proposed
for the reporting of information related
to the Federal mental health prohibitor.
Another commenter who supported a
permission to disclose information
about individuals who are subject to
State-only mental health prohibitors
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
argued that increasing the disclosures to
the NICS about individuals who are
prohibited by State law (but perhaps not
Federal law) from purchasing firearms
could address the situation in which a
person who is subject to a prohibitor in
the person’s State of residence enters
another State temporarily for the sole
purpose of obtaining a firearm and then
returns to the State where ownership is
prohibited with a firearm. This
commenter voiced the concern that, if
the State of residence does not provide
information about individuals who are
subject to State law prohibitors to the
Federal background check system, a FFL
in another State would not know that
the individual is subject to a prohibitor.
Several commenters asserted that an
express permission to disclose
information about individuals who are
subject to State mental health
prohibitors would help to avoid a
misinterpretation that HIPAA prohibits
disclosures of PHI relevant to State
mental health prohibitors in
circumstances when HIPAA otherwise
would not. Another commenter argued
that, as some State law prohibitors were
enacted before HIPAA, State legislators
would not have foreseen HIPAA-related
obstacles to disclosure or the resulting
need to require reporting to the NICS by
law; as a result, those States may not
have laws in place to require the
reporting of State law prohibitors.
One commenter who supported
extending the permission argued that
the reporting of State mental health
prohibitors would be consistent with
congressional intent, as expressed
through statutes aimed at preventing
gun violence. The commenter asserted
that the NICS was established under the
Brady Gun Law to serve as a central
aggregated database of information
regarding the identities of individuals
who are prohibited from possessing
firearms under any Federal, State, or
local law.
In contrast, a number of commenters,
including several associations of mental
health professionals, expressed concern
that expanding the reporting permission
to apply to State law mental health
prohibitors would involve more treating
health care providers in NICS reporting,
and that individuals would not seek
treatment for mental health problems if
they felt that simply by seeking
treatment they could be reported to the
NICS.
Several commenters, including two
mental health professional associations,
expressed concern that State mental
health prohibitors are being expanded
in an overly broad manner that will
further negative attitudes and
misperceptions about mental illness.
PO 00000
Frm 00018
Fmt 4700
Sfmt 4700
The commenters pointed to an example
of a State statute that requires health
care providers to report to the NICS the
identities of all individuals with
intellectual disabilities, as well as
individuals who voluntarily commit
themselves to a mental institution.
The CCDRTF provided additional
examples of State law mental health
prohibitors that are significantly broader
than the Federal mental health
prohibitor and expressed concern that
many of these State prohibitors apply to
individuals without the benefit of an
adjudication by a court, board,
commission or other lawful authority, as
provided for under the Federal
prohibitor.28 This commenter asserted
that the Federal mental health
prohibitor forbids the reporting of
information to the NICS about
individuals who are subject to broader
State mental health prohibitors due to a
lack of equivalent procedural
protections for such individuals;
therefore, this commenter argued, to
permit reporting related to State mental
health prohibitors would violate the
Supremacy Clause and raise due process
concerns.
A number of commenters who
opposed the reporting of State mental
health prohibitors expressed concern
that the broadest State law prohibitors
would become the de facto national
standard if the NICS were to include
State law prohibitors. Others raised
concerns about the increased
complexity involved in accurately
maintaining the NICS database with the
addition of State law prohibitor records,
including challenges associated with
avoiding or identifying duplicate
reports, resulting in less reliability,
increased inaccuracy, and improper
28 This commenter described laws enacted in four
States. According to the commenter, New York law
requires all mental health professionals to report
any person undergoing treatment that is ‘‘likely to
engage in conduct that would result in serious harm
to self or others’’ (citing N.Y. Mental Hygiene. Law
§ 9.46), while New York’s SAFE Act requires mental
health treatment providers to report covered
individuals to a state database without an
adjudicatory process (citing N.Y. Mental Hygiene
Law § 9.46). In California, the commenter stated,
prohibitors apply to individuals undergoing
voluntary inpatient treatment (citing 30 Cal. Welf.
& Inst. Code § 8100(a)); and apply to individuals
involuntarily held as inpatients under 72-hour
holds (citing Cal. Welf. & Inst. Code § 8103(f) and
Cal. Welf. & Inst. Code § 5150) without the types of
adjudications contemplated under the Federal
mental health prohibitor (citing 18 U.S.C. 922(g);
U.S. v. Rehlander, 666 F.3d 45, 50 (1st Cir. 2012).
Finally, the commenter noted that Illinois and
Hawaii have prohibitors that apply to all
individuals who have received particular diagnoses
(citing 31 430 Ill. Comp. Stat. 65/8(g) (intellectual
disability) and (s) (developmental disability); Haw.
Rev. Stat. Ann. § 134–7(c) (persons with significant
DSM diagnosed disorder).
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
denial of rights, as well as adding
complexity to appeals.
Response: We share the concerns of
commenters that, due to the breadth of
some State law prohibitors, the
inclusion of State-only prohibitors in
the permission would increase the
involvement of treating providers in
NICS reporting, which could negatively
affect patient-provider treatment
relationships and discourage some
individuals from seeking care. While we
note that the NICS currently receives
some information on State law
prohibitors, given these concerns and
the importance of protecting the patientprovider relationship, we do not think
it is appropriate to expand the
permission with respect to HIPAA
covered entities. We agree with the
commenters who stated that the health
and safety of individuals and the public
is best served if persons with mental
illness obtain appropriate treatment; by
limiting the permission to the narrower
Federal mental health prohibitor, and
carefully tailoring the permission in the
ways described throughout this
preamble, this final rule is designed to
ensure that such persons are not
discouraged from seeking care.
With respect to some commenters’
concerns about State mental health
prohibitors being ineffective without a
HIPAA disclosure permission, we note
that the Privacy Rule does not affect the
reporting of State law prohibitors by
non-HIPAA covered entities, which are
the entities that maintain most of the
relevant information. Moreover, to the
extent that covered entities maintain
relevant State law prohibitor
information and a State wants to ensure
that the reporting of this information
can occur, the Privacy Rule provides
certain other avenues for disclosure, as
we have described elsewhere. For
example, although our balancing of
interests limits this express permission
under HIPAA to disclosures related to
the Federal mental health prohibitor,
this rule does not prevent State
legislators from differently balancing the
privacy, health, and public safety issues
involved with respect to their State level
mental health prohibitors—nor does the
Federal mental health prohibitor itself
prohibit reporting to the NICS of State
law prohibitor information, as a
commenter asserted. If State legislators
determine that information related to a
State-only prohibitor should be
disclosed despite any potential chilling
effect on seeking treatment, they can
enact a State law requiring the relevant
entities to report such information.
Alternatively, the relevant covered
entities can create a hybrid entity,
separating their HIPAA covered health
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
care functions from their NICS reporting
or repository functions, such that the
information maintained by the covered
health care component is subject to the
Privacy Rule, while information held by
the non-covered component can be
reported without regard to the Privacy
Rule.
We disagree with the commenters
who argued that excluding State-only
mental health prohibitor information
from the permission will create
confusion. We do not think this will
occur because this final rule clearly
indicates that it applies where firearm
possession is prohibited under a
specific provision in Federal law. We
also note that the rule delineates the
types of covered entities that are
permitted to disclose, the information
they are permitted to share, the
categories of individuals covered by the
permission, and the entities to which
they can make such disclosures. In
addition, we intend to work with DOJ to
develop additional guidance on the
categories within the Federal mental
health prohibitor. Moreover, we do not
believe this final rule will create a
misperception that HIPAA always
prohibits the reporting to the NICS of
individuals who are subject to Stateonly mental health prohibitors. As
explained elsewhere in this preamble,
the Privacy Rule already permits uses
and disclosures of PHI that are required
by law, including State law reporting
requirements; also, HIPAA covered
entities that perform both health care
and non-health care functions (e.g.,
NICS reporting) are permitted to create
hybrid entities under HIPAA so that the
Privacy Rule applies only to their health
care functions. This final rule does not
change those provisions.
Finally, we do not agree that Congress
intended for State (or local) law
prohibitor information to be reported to
the NICS in all circumstances, such as
where doing so would conflict with
countervailing privacy concerns due to
the treatment relationship between
patients and health care providers.
Therefore, this final rule balances a
variety of important interests, including
protecting the privacy of individuals’
personal health information, ensuring
access to needed mental health care
services, and advancing the public
safety interests in ensuring that persons
who are prohibited by Federal law from
purchasing or possessing a firearm for
mental health reasons do not gain access
to firearms.
Entities Permitted To Report
Comment: Several commenters,
including the AMA and the National
Association of Psychiatric Health
PO 00000
Frm 00019
Fmt 4700
Sfmt 4700
389
Systems, expressed support for the
proposal to limit the permission to only
those entities in a State that are directly
involved in the relevant adjudications
or maintain records of them for NICS
reporting purposes. These commenters
expressed appreciation for the narrow
drafting of the NPRM based on the need
to support provider-patient
relationships and encourage individuals
with mental illness to seek appropriate
care.
However, several advocacy
organizations and many individuals
argued that direct treatment providers
should not be permitted to report
information about their patients to the
NICS under any circumstances (i.e.,
even if they are, or are part of, the entity
that orders involuntary commitments or
conducts other relevant adjudications,
or serves as a repository of NICS data).
Some of these commenters argued that
reports to the NICS database should
come only from the judiciary.
Finally, we did not receive responses
to the question we posed in the NPRM
about whether additional types of
covered entities within a State (other
than those identified in the proposed
regulatory text) might be expected, and
thus should be permitted under the
Privacy Rule, to report data to the NICS
or to a State repository.
Response: We agree with the
commenters who emphasized the need
to protect the provider-patient
relationship, and this final rule
addresses such concerns by limiting the
permission to those covered entities that
also perform an adjudicatory or data
repository function. Furthermore, as
described more fully elsewhere in this
preamble, the permission does not
extend to broader State law prohibitors,
which may not require a formal
adjudication or involuntary
commitment and whose inclusion likely
would involve more treatment providers
in NICS reporting.
In response to comments arguing that
only entities in the court system should
be permitted to report to NICS, it is our
understanding, based on public
comments and our fact finding, that
courts do not create or maintain records
of all of the involuntary commitments or
other adjudications that make
individuals subject to the Federal
mental health prohibitor. Therefore, for
the NICS database to include reports of
all persons subject to the mental health
prohibitor, it is necessary for certain
other entities that create or maintain
such information to be able to report.
We believe this permission will help
strengthen the background check system
to ensure that individuals who are
prohibited from purchasing or
E:\FR\FM\06JAR1.SGM
06JAR1
390
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
possessing firearms are prevented from
obtaining them. We also acknowledge
the concerns of commenters who argued
that providers should not be permitted
to report information about their
patients under any circumstances. As
explained in more detail elsewhere in
this preamble, to address these and
other concerns, we have carefully
tailored this final rule to limit the
involvement health care providers, and
to prevent disclosures of diagnostic or
clinical information for NICS reporting
purposes.
wgreen on DSK2VPTVN1PROD with RULES
Demographic and Certain Other
Information Permitted To Be Reported
Comment: Many commenters
specifically voiced support for the
NPRM’s proposal not to permit the
disclosure of diagnostic or clinical
information for NICS reporting
purposes. (We also noted in the NPRM
that the NICS does not request or
contain such information.) For example,
the American Medical Association
stated that it strongly supported
restricting the information disclosed to
the limited demographic and other
information needed for reporting, as the
NPRM proposed. To support the point
that NICS reporting is sufficiently
limited, another commenter pointed out
that the information that is reported to
the NICS generally is provided by the
individual to a FFL on the required
application for the firearm.
In contrast, one commenter asserted
that, as written, the proposed
permission would grant discretion to
state entities to determine the scope of
‘‘demographic and certain other
information’’ to be reported and argued
further that DOJ (specifically ATF), not
HHS, has authority to define the
‘‘minimum’’ information required by
NICS.
In response to our request for
comment on whether, and in what
circumstances, entities currently report,
or should be permitted to report,
additional data elements needed to
confirm an individual’s identity, the
Connecticut Department of Mental
Health and Addiction Services
(DMHAS) asserted that certain
additional data elements are helpful in
confirming whether an individual is
appropriately excluded from gun
purchase or possession in cases where
multiple individuals share the same
name and date of birth. Several other
commenters agreed that permitting the
disclosure of additional data elements
for NICS reporting purposes would
allow more accurate verification of an
individual’s identity, resulting in fewer
erroneous denials, and would facilitate
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
the correction and updating of NICS
entries.
The Connecticut DMHAS and others
suggested the inclusion of some or all of
the following specific data elements:
Social Security number, place of birth,
state of residence, height, weight, eye
color, hair color, and race. Social
Security number and race were cited as
the most reliable indicators of an
individual’s true identity.
Response: We agree with the
commenters who stated that limiting the
permission to exclude diagnostic and
clinical information appropriately
balances individuals’ privacy interests
and public safety priorities. We also
agree that there may be data elements
beyond those needed to create the NICS
record (i.e., the individual’s name, sex,
and date of birth; as well as codes
identifying (1) the Federal mental health
prohibitor, (2) the record documenting
the involuntary commitment or
adjudication, and (3) the entity from
which the record initiated) that may be
helpful in verifying identity and
excluding false matches. Given that, the
final rule provides some flexibility for
States or reporting entities. We do not
specify in the regulatory text which data
elements may be disclosed, but clarify
in this preamble that what generally
would be considered the information
‘‘needed for purposes of reporting to the
[NICS]’’ in § 164.512(k)(7)(iii)(A) would
be the data elements required to create
a NICS record, as well as the following
elements to the extent necessary to
exclude false matches: Social Security
number, State of residence, height,
weight, place of birth, eye color, hair
color, and race (and we note that the
Federal Bureau of Investigations (FBI)
and not ATF has the authority to define
the information required by NICS). As
indicated above, these are the same
elements that were identified in the
NPRM.
C. Comments Regarding the NICS and
the Federal Mental Health Prohibitor
Comment: Many commenters raised
concerns about infringement of
individuals’ Second Amendment right
to bear arms without due process. A
number of these commenters
specifically expressed concern that an
individual could be reported to the
NICS without a formal adjudication
through the court system and argued
that due process under the Constitution
would require a hearing in a court of
law before an individual could be made
subject to the Federal mental health
prohibitor.
Response: We acknowledge the views
of the commenters. However, as we
explained in the NPRM, these concerns
PO 00000
Frm 00020
Fmt 4700
Sfmt 4700
relate to the Federal mental health
prohibitor rather than the HIPAA
Privacy Rule or this final rule, and thus
are outside the scope of this rule. This
final rule addresses HIPAA-related
barriers to entities reporting certain
information to the NICS about
individuals who are subject to the
Federal mental health prohibitor. The
rule does not expand the categories of
federally prohibited persons or modify
the criteria for determining that a person
is subject to the Federal mental health
prohibitor.
Comment: Several disability rights
advocates and others asserted that the
rule would not result in a decrease in
gun violence because mental illness
alone does not make a person more
likely to commit violence against others.
The Consortium for Citizens with
Disabilities Rights Task Force (CCDRTF)
cited studies indicating that mental
illness alone is not statistically related
to future violence and that even severe
mental illness without drug use or a
history of violence is not linked with
future violence.29 Several commenters
also noted that persons with mental
illness are more likely to be the victims
of violence than its perpetrators.
Alternatively, several commenters
argued that, even if there were a link
between mental illness and gun
violence, the proposed rule is not
needed because mechanisms already are
in place in place to prevent harm from
patients who are a threat to themselves
or the public.
Response: We acknowledge the views
of the commenters. However, these
commenters address the applicability of
the Federal mental health prohibitor
itself. This final rule does not expand
the existing categories of persons
prohibited from owning a firearm or
modify other Federal or State laws
pertaining to firearms purchases.
Therefore, these comments are beyond
the scope of this rule.
Comment: Several commenters raised
questions about individuals’ ability to
correct erroneous NICS reports or to
29 CCDRTF cited Eric B. Elbogen & Sally C.
Johnson, The Intricate Link Between Violence and
Mental Disorder: Results from the National
Epidemiologic Survey on Alcohol and Related
Conditions, 66 Arch. Gen. Psychiatry 152, 157 (Feb.
2009); David J. Vinkers, et al., Proportion of Crimes
Attributable to Mental Disorders in the Netherlands
Population, 11 World Psychiatry 134 (June 2012).
CCDRTF also indicated that other studies showed
a modest relationship between serious mental
illness and violence, but that other factors (e.g.,
substance abuse, age, gender and lower economic
status) contribute more to increasing the likelihood
of committing violence than mental illness alone.
They cited R. Van Dorn, et al., Mental Disorder and
Violence: Is There a Relationship Beyond Substance
Use?, 47 Social Psychiatry and Psychiatric
Epidemiology 487, 499 (2012).
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
have their rights restored when they no
longer pose a danger to themselves or
others. A number of commenters
recommended assuring that the appeals
process is free of delay, inexpensive,
and easy for individuals to initiate.
Other commenters asserted that the
expense to remove oneself from the
NICS database is prohibitive for some
individuals. As a result, the commenters
said, individuals effectively become
subject to a lifelong restriction on their
Second Amendment right to bear arms,
even after they recover from the
condition that led to their adjudication
and are eligible to apply for relief from
disabilities under the Federal mental
health prohibitor. Similarly, one
commenter argued that, once an
individual is reported to the NICS, the
‘‘relief from disabilities’’ process 30 is
inadequate for remediation due to a lack
of Federal funding to support State
programs, and wide variability in State
programs to provide relief as a result.
Another commenter recommended
allocating additional funding to support
State ‘‘relief from disabilities’’ programs.
Response: These comments are
outside the scope of the rule. However,
we acknowledge the commenters’
concerns with respect to opportunities
for remediation and note that
individuals who believe they are
wrongly denied the purchase of a
firearm can visit https://forms.fbi.gov/
nice-appeals-request-form to find out
more information and appeal their
denial. In addition, the NICS
Improvement Amendments Act of 2007
authorized grants for States that
implement programs for ‘‘relief from
disabilities’’ in accordance with the
Act.31 These programs are required to
establish processes by which an
individual who is subject to the Federal
mental health prohibitor may apply for
relief to the State where the relevant
commitment or adjudication occurred.
While States’ processes for granting
relief vary, the Act requires that relief be
granted if it can be established that the
circumstances regarding the disability
and the applicant’s record and
reputation are such that the applicant
will not be likely to act in a manner
dangerous to public safety, and the
granting of relief would not be contrary
to the public interest.32
Comment: A number of commenters
expressed concern that a finding of
mental incompetence by the Veterans
Administration (VA), which could make
30 See
footnote 13 above.
DOJ Bureau of Justice Statistics provides
state data on NICS Act Record Improvement
Program (NARIP) Awards (available at https://
www.bjs.gov/index.cfm?ty=tp&tid=491#promising).
32 See Public Law 110–180, Section 105.
31 The
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
an individual subject to the Federal
mental health prohibitor and cause the
individual to be reported to the NICS,
may be based solely on a determination
that the veteran is unable to handle
financial affairs, without regard to
dangerousness. The commenters argued
that these veterans do not receive due
process before being made subject to the
Federal mental health prohibitor and
believed that the proposed rule would
exacerbate this problem.
Response: We note that, as a federal
agency, the VA is required by law to
report prohibited persons to the
Attorney General, who oversees the
NICS.33 This final rule does not affect
that requirement or change the
procedures relating to adjudications that
make individuals subject to the Federal
mental health prohibitor.34
D. Other Comments
Comment: A few commenters
expressed concern that covered entities
would misinterpret the proposed
permission as a requirement to report
information about their patients to the
NICS. Another commenter expressed
concern that the standards for reporting
NICS data will be adopted by courts as
a new standard of care for health care
providers, exposing covered entities that
do not report to increased liability. The
commenter requested that the
Department clarify that the HIPAA
permission is permissive, not
mandatory.
Response: This final rule establishes
permission for certain HIPAA covered
entities—those with lawful authority to
make the adjudications or commitment
decisions that make individuals subject
to the Federal mental health prohibitor,
or that serve as repositories of
information for NICS reporting
purposes—are permitted to disclose the
information needed for these purposes.
The rule does not create a requirement
to disclose. In addition, as explained at
length in the NPRM and above, the rule
does not apply to most treating
providers, but only to those covered
entities that are responsible for the
involuntary commitments or other
adjudications that make individuals
subject to the Federal mental health
prohibitor, or that serve as repositories
of such data. However, we note that
covered entities have a responsibility to
comply with all applicable laws, and
this final rule does not preempt State or
33 See NICS Improvement Amendments Act of
2007 Sec. 101, 18 U.S.C. 922 note (2002).
34 We refer commenters to the VA regulations for
information about the due process afforded to
veterans as part of VA competency determinations.
See 38 CFR 3.353 and 38 CFR 3.103.
PO 00000
Frm 00021
Fmt 4700
Sfmt 4700
391
other laws that may require reporting to
the NICS.
Comment: One commenter
recommended that the Department
evaluate whether the rule would have
the unintended consequence of
permitting the reporting of individuals
based on mere medical findings.
Response: As we explain above, the
rule does not create a broad permission
for treating providers to report
information about their patients to the
NICS. Rather, the rule is narrowly
tailored to permit limited disclosures of
information about individuals who are
subject to the Federal mental health
prohibitor, which applies only where an
individual has been involuntarily
committed or otherwise has received a
relevant adjudication from a court,
board, commission, or other lawful
authority.
Comment: One commenter
recommended training for the workforce
members of reporting entities to ensure
that they understand the applicable
reporting protocols sufficiently to avoid
making erroneous reports.
Response: We agree that training is
generally beneficial to assure
compliance with applicable standards.
Further, to the extent that reporting
entities also are HIPAA covered entities,
the Privacy Rule requires those entities
to train workforce members on the
policies and procedures with respect to
the privacy and security of individuals’
health information. Where applicable,
such training would include ensuring
that workforce members have copies of
the entity’s policies and procedures
implementing this final rule’s limited
permission for uses or disclosures of
PHI for NICS reporting purposes.
Comment: One commenter
recommended establishing a mechanism
to inform mental health patients and
their caregivers about the patients’
status in the NICS.
Response: We decline to provide for
such a mechanism in this final rule
because it is outside the scope of the
rule. Nothing in this rule, however,
precludes covered entities from
informing individuals that information
about them has been provided to the
NICS.
Comment: Several commenters
expressed concern that, by allowing
multiple entities within a State to report
to the NICS, the proposed rule would
create complexity, inaccuracy, and
delay in processing appeals, particularly
if the FBI refers the individual back to
the reporting entity for resolution.
Response: To the extent that the
involvement of multiple entities in
NICS reporting may affect the appeals
process in a state, this issue exists apart
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
392
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
from HIPAA. Each State determines the
entity or entities responsible for
reporting NICS data, depending on
where the records documenting a
person’s status as subject to one or more
of the Federal prohibitors are created or
maintained. As a result, a variety of
entities, including judicial, law
enforcement, public health, and other
entities in a State, already may be
involved in NICS reporting and appeals.
Comment: A few commenters
expressed concern that, as a result of the
proposed rule, some families may
choose not to seek involuntary
commitment proceedings for a family
member who needs treatment, but
whose livelihood depends on the ability
to possess a firearm (e.g., first
responders and members of the
military), because the commitment
would result in a report to the NICS and
the loss of the patient’s livelihood.
Response: We note that the Federal
mental health prohibitor makes the
purchase or possession of firearms by
prohibited individuals unlawful
regardless of whether an individual is
reported to the NICS, and this final rule
does not change who is subject to the
Federal mental health prohibitor. This
final rule also does not affect law
enforcement and military entities’
authorities with respect to making their
workforce decisions.
Comment: One commenter asked
whether covered entities are obligated to
update information they have submitted
to the NICS when an individual’s
circumstances change.
Response: Section 102(c)(1)(B) of the
NIAA requires States to update, correct,
modify, or remove a record from the
NICS if they determine that the person
is not prohibited or has received ‘‘relief
from disabilities’’ under the mental
health prohibitor.
Comment: A number of commenters
argued that the proposed regulation
would contravene congressional intent,
arguing that Congress did not intend to
change HIPAA protections for NICS
purposes. The commenters stated that
legislation on this topic had been
considered and rejected and specifically
cited S. 649 (the ‘‘Fix Gun Checks Act’’),
which was considered by the Senate on
April 18, 2013, but did not receive a
vote.
Similarly, some commenters asserted
that Congress could have included any
desired changes to HIPAA when it
passed the NICS Improvements
Amendments Act, but did not do so.
Therefore, the commenters argued,
Congress did not intend to modify
HIPAA for NICS reporting purposes.
Response: That Congress did not
enact S. 649 does not provide relevant
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
evidence of congressional intent with
respect to the scope of the HIPAA
Privacy Rule. The absence of a provision
in the NIAA to modify HIPAA does not
imply that Congress intended to prevent
any revisions of the HIPAA Privacy Rule
with respect to the NICS. The HIPAA
statute confers broad authority on the
Department to specify the permitted
uses and disclosures of PHI by HIPAA
covered entities, and NIAA does not
affect this statutory authority.
Comment: Several disability rights
organizations asserted that the proposed
rule did not provide sufficient evidence
of HIPAA barriers to reporting in any
State to fulfill a requirement of the
Administrative Procedure Act (APA)
that there be a rational connection
between the facts found by a Federal
agency through the rulemaking process
and the regulatory choice made.35
Response: We disagree with the
commenters. As stated above, we
understand from other comments that at
least seven States currently rely on
HIPAA covered entities (such as mental
health facilities) to report Federal
mental health prohibitor data to the
NICS. These seven States have laws
regarding such reporting, but other
States may not. To the extent that any
other State does not require NICSrelated disclosures by law and the State
has not enacted legislation addressing
the problem, the Privacy Rule, prior to
the effective date of this final rule,
would have prevented such disclosures
by HIPAA covered entities that do not
have hybrid entity status.36 Therefore,
there are sufficient data demonstrating
that HIPAA’s disclosure restrictions can
be a barrier to NICS reporting, and thus
to the development of an accurate and
comprehensive NICS database. The data
support finalizing this modification to
the Privacy Rule, which removes
barriers while limiting the
circumstances under which covered
entities may disclose PHI to the NICS
and limiting the types of PHI that may
be disclosed.
We know of one State in particular in
which the Privacy Rule’s disclosure
restrictions posed challenges for NICS
reporting. The State of New York had a
statute requiring mental health facilities
in the State to report NICS data to the
State mental health agency, the State’s
U.S.C. Subchapter II.
note that at least three states have laws
permitting, but not requiring the disclosure of
mental health records to the NICS: Missouri, New
Jersey and West Virginia. See Mo. Rev. Stat. 630.140
(2013); N.J. Stat. Ann. 30:4–24.3 (2013); W.Va. Code
61–7A–3 (2013).
designated repository of NICS data.37 As
a result, the Privacy Rule permitted
such disclosures to the repository as
required-by-law disclosures. However,
the statute did not expressly require the
mental health agency, which was a
covered entity under HIPAA that did
not have hybrid entity status, to report
the data it collected to the NICS; the
Privacy Rule thus did not permit the
agency to disclose this data. Ultimately,
the legislature needed to revise the
statute to expressly require the agency
to report the data to the NICS.38
In addition to removing barriers, an
additional benefit of the rule as
described more fully below is that it
provides clarity about the applicability
of the Privacy Rule and its relationship
to State law in this area, as well as
provides an avenue for NICS reporting
that may obviate the need to enact
legislation at the State level.
Comment: One commenter requested
that the Department clarify how
HIPAA’s preemption provisions would
apply to State laws requiring or
prohibiting covered entities’ disclosures
of NICS data.
Response: We clarify that this final
rule does not change HIPAA’s existing
preemption provisions, which provide
that the HIPAA rules preempt contrary
State laws (with certain exceptions,
such as where the contrary provision of
State law is more stringent than the
HIPAA provision).39 Accordingly,
because the Privacy Rule, as modified
by this final rule, only permits (but does
not require) the disclosure for NICS
reporting purposes, State laws that
prohibit such disclosures are not
contrary to the Privacy Rule, and
covered entities in States with such
laws remain subject to any applicable
prohibitions against the disclosures
under State law. That is, the covered
entity could comply with both HIPAA
and such State law by not disclosing
PHI to the NICS.
Moreover, HIPAA contains an express
permission for disclosures that are
required by other law, such as State law.
Accordingly, State laws that require
disclosures, for any purposes, remain in
effect, as such laws are not contrary to
the Privacy Rule.
Comment: One commenter expressed
concern that the rule would create an
opportunity for the abuse of private
information, for example, by allowing
the government to disarm political
dissidents who seek mental health care,
35 5
36 We
PO 00000
Frm 00022
Fmt 4700
Sfmt 4700
37 2008 N.Y. Laws 491, codified at N.Y. Mental
Hyg. §§ 7.09(j); 13.09(g), 31.11(5), 33.13(b), (c)
(2011); N.Y. Jud. Ct. Acts § 212(q) (2011).
38 NY Secure Ammunition and Firearms
Enforcement (SAFE) Act of 2013.
39 See 45 CFR 160.203.
E:\FR\FM\06JAR1.SGM
06JAR1
wgreen on DSK2VPTVN1PROD with RULES
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
or making it possible for medical
personnel to abuse their authority and
remove an individual’s rights for
illegitimate reasons.
Response: Concerns about
governmental or private actors taking
advantage of this permission to target
vulnerable persons are addressed by the
procedural framework built into the
statute that established the Federal
mental health prohibitor and its
implementing regulations, which this
final rule does not change. As we
previously have noted, the Federal
mental health prohibitor, which makes
an individual reportable to the NICS,
applies only to the extent that the
individual is involuntarily committed or
determined by a court, board,
commission, or other lawful authority to
be a danger to self or others, or is unable
to manage his or her own affairs due to
a mental illness or condition. 40 These
involuntary commitments and other
adjudications are not made
independently by individual health care
providers without any form of official
legal review.
Comments: Some commenters
expressed concern that, by relaxing
HIPAA’s privacy requirements, the
proposed rule could result in increased
disclosures of private health
information to the government. Several
commenters argued that the Federal
government has a poor record on
protecting individuals’ privacy and
should not be entrusted with health
information. In contrast, another
commenter noted that Federal law,
including the Privacy Act, prohibits
access to the information in the NICS
database outside of the limited purposes
authorized by law, and information
about specific firearms transfers is
destroyed the day after the transaction.
Response: We agree that it is
important to protect the privacy and
security of the information that is
reported to the NICS and we note that
the NICS is subject to specific privacy
and security protections.41 In addition,
we again emphasize that only very
limited information may be disclosed
under this rule, and disclosures of
diagnostic or clinical information are
expressly prohibited.
Comment: Finally, one commenter
requested clarification on whether, in
States where a covered entity is also a
lawful authority that orders involuntary
commitments or conducts other
adjudications that make individuals
subject to the Federal mental health
prohibitor, there is intended to be a
40 18
U.S.C. 922(g)(4); 27 CFR 478.11.
63 FR 58303 (October 30, 1998), codified
at 28 CFR part 25.
41 See
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
separation between the covered entity
and lawful authority functions of the
entity.
Response: We note that, under the
Privacy Rule, both before and after the
modification made in this final rule, a
covered entity could provide for such
separation by operating as a hybrid
entity, and disclose information through
its non-HIPAA covered NICS reporting
unit. However, it is our understanding
that some covered entities may be
unable to achieve hybrid entity status
for administrative or other reasons. This
is another reason for including the
express permission described in the
final rule.
VI. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact
statement in compliance with Executive
Order 12866 (September 1993,
Regulatory Planning and Review),
Executive Order 13563 (January 2011,
Improving Regulation and Regulatory
Review), the Regulatory Flexibility Act
(RFA) (September 19, 1980, Pub. L. 96–
354), the Unfunded Mandates Reform
Act of 1995 (UMRA) (March 22, 1995,
Pub. L. 104–4), and Executive Order
13132 on Federalism.
1. Executive Order 12866 and Executive
Order 13563
Executive Orders 12866 and 13563
direct agencies to assess all costs and
benefits of available regulatory
alternatives and, if regulation is
necessary, to select regulatory
approaches that maximize net benefits
(including potential economic,
environmental, public health and safety
effects, distributive impacts, and
equity). Executive Order 13563
emphasizes the importance of
quantifying both costs and benefits, of
reducing costs, of harmonizing rules,
and of promoting flexibility. This rule
has been designated a ‘‘significant
regulatory action’’ although not
economically significant, under section
3(f) of Executive Order 12866.
Accordingly, this rule has been
reviewed by the Office of Management
and Budget.
A regulatory impact analysis must be
prepared for all major rules that have
economically significant effects ($100
million or more in any one year) or
adversely affect in a material way the
economy, a sector of the economy,
productivity, competition, jobs, the
environment, public health or safety, or
State, local, or tribal government or
communities (58 FR 51741). Because the
final rule does not contain any new
requirements or prohibitions for covered
PO 00000
Frm 00023
Fmt 4700
Sfmt 4700
393
entities, we estimate that the rule will
be cost neutral. We did not receive
public comments on this assumption or
information indicating that covered
entities will incur any costs as a result
of the rule.
Although we expect the economic
impact of the rule, including nonquantifiable costs and savings discussed
in the regulatory analysis below, to be
less than $100 million annually, we
nevertheless conducted an analysis of
the costs of the final rule.
2. Entities Subject to the Rule
This final rule applies only to covered
entities that function as repositories of
information relevant to the Federal
mental health prohibitor on behalf of a
State or that are responsible for ordering
the involuntary commitments or other
adjudications that make an individual
subject to the Federal mental health
prohibitor. We do not have sufficient
data to determine the number of affected
entities, but, based on the information
available to us, we believe there would
be very few. Our understanding is that,
for the most part, formal adjudications
and repository functions of this nature
are conducted by entities, such as court
systems or law enforcement agencies,
that are not covered by HIPAA. In
addition, even covered entities in some
states will not be affected because they
currently do not face HIPAA barriers to
reporting either because state law
requires reporting or they have created
hybrid entities, as described above in
the preamble. We did not receive public
comments on the number of covered
entities that will be affected by this rule.
B. Why is this rule needed?
This final rule is needed to ensure
that, where HIPAA covered entities
make adjudications causing individuals
to become subject to the Federal mental
health prohibitor, or serve as
repositories of records of such
adjudications on behalf of States, those
covered entities can report the identities
of those individuals to the NICS. This
rule change can help further the
important public safety goal of
strengthening the background check
system to ensure that individuals who
are prohibited from purchasing or
possessing firearms are not able to
obtain them. Specific permission under
the Privacy Rule for these disclosures is
necessary to the extent that some States
have not enacted laws requiring
reporting to the NICS, but a covered
entity in the State is nevertheless
responsible for such reporting and does
not become a hybrid entity. Importantly,
the final rule permits only a small
subset of HIPAA covered entities (i.e.,
E:\FR\FM\06JAR1.SGM
06JAR1
394
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
wgreen on DSK2VPTVN1PROD with RULES
those that perform the relevant mental
health adjudications or repository
functions) to use or disclose only
limited, non-clinical information, for
NICS purposes. This narrowly tailored
permission permits these important uses
or disclosures for public safety to occur
while maintaining a separation between
reporting functions and the mental
health treatment a patient might be
receiving.
C. Qualitative Analysis of Unquantified
Costs
The rule is cost neutral with respect
to HIPAA covered entities. The rule
does not require entities that already
have a NICS reporting process in place
to change their current system and does
not create new reporting or
recordkeeping requirements for any
covered entity. The small number of
covered entities that are newly
permitted to report to the NICS or a
State repository under the rule can
begin to report and may need to develop
policies and procedures to do so. As the
Privacy Rule only allows the use or
disclosure of information, and does not
require it, any resulting burden of
reporting and associated procedures are
attributable to the choice made by an
entity to report information, the Federal
statutory mental health prohibitor, and
the NICS system itself. See 28 CFR part
25, subpart A. We acknowledge that
those entities that choose to begin
reporting may wish to address this
change in their HIPAA policies and
procedures, as well as explain their
procedures to office staff. However, the
rule does not require any changes to
existing HIPAA policies and
procedures. In addition, with respect to
training, the rule does not require
workforce training beyond what is
already required under the HIPAA
Privacy and Security Rules. We expect
that entities that choose to report under
the rule would also take steps to ensure
that their office staff have copies of the
new policies and procedures, which
would not involve any significant
additional costs. We did not receive
public comments contradicting these
assumptions or estimating the number
of entities that might begin to report to
the NICS for the first time, if any.
To the extent that the rule permits
some covered entities to report to the
NICS for the first time, there may be an
increase in the number of individuals
whose identities are newly included in
the NICS and who are denied a firearm
transfer as a result. Therefore, there may
be a concomitant increase in
applications for ‘‘relief from
disabilities’’ in states that provide such
a relief program. However, any burden
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
to individuals completing and
submitting the relief application form is
attributable to the Federal mental health
prohibitor and the procedures
established by the State where the
commitment or adjudication occurred.
The procedures for applying for relief in
States that have established mental
health prohibitor ‘‘relief from
disabilities’’ programs pursuant to the
NICS Improvement Amendments Act of
2007 vary.
We received a number of comments
on the NPRM asserting that creating an
express permission in the Privacy Rule
for NICS reporting would discourage
individuals from seeking needed mental
health care. We appreciate these
concerns and agree with commenters
who asserted that individuals’ health
and the public’s safety are best served
by encouraging appropriate treatment.
We also recognize that discouraging
treatment could increase the burden of
untreated mental conditions to
individuals, in the form of increased
suffering and loss of productivity; to the
health care system, when individuals
with untreated mental illness need
emergency hospitalization, for example;
and to the public’s safety. However,
many of these commenters expressed
the mistaken belief that the permission
would allow or require most mental
health care providers to report their
patients to the NICS.
As explained above, we have carefully
and narrowly tailored the final rule to
apply only to a small number of covered
entities that may be responsible for the
adjudications that make an individual
subject to the Federal mental health
prohibitor, or that serve as repositories
of data about such adjudications. The
rule generally maintains a separation
between treatment functions and NICS
reporting functions. In addition, the rule
does not permit the use or disclosure of
any diagnostic or clinical information,
or any other information about an
individual that is not needed for NICS
reporting purposes. Because of these
strict limitations on the permitted uses
and disclosures, we believe that
individuals will not be dissuaded from
seeking needed mental health care
services as a result of the rule.
Finally, we recognize the intangible
burden to individuals of the negative
attitudes and misperceptions associated
with mental health conditions. We note
that the Federal mental health
prohibitor does not apply to all
individuals with mental health
conditions, but instead to a subset of
individuals who have been
involuntarily committed or determined
by a lawful authority to be a danger to
themselves or others, or unable to
PO 00000
Frm 00024
Fmt 4700
Sfmt 4700
manage their own affairs, as a result of
marked subnormal intelligence, or
mental illness, incompetency,
condition, or disease. This rule permits
a limited number of HIPAA covered
entities to report to the NICS the
identities of individuals in a particular
subcategory of persons who are
currently prohibited by Federal law
from possessing firearms. This
permission facilitates the enforcement
of prohibitions that were established by
the Gun Control Act. Therefore, we do
not expect that this rule will exacerbate
negative attitudes or misperceptions
associated with mental health
conditions.
D. Qualitative Analysis of Unquantified
Benefits
While we believe that there may be
benefits to public safety as a result of
the rule, we are not able to monetize the
value of such benefits.
For example, by removing a barrier to
reporting, the rule may result in
increased reporting to the NICS of
individuals who may pose a risk of gun
violence related to a serious mental
health condition. To the extent that this
rule permits covered entities to report
those individuals’ identities for NICS
purposes, the rule provides a public
safety benefit. One comment submitted
in response to the NPRM noted that
increased reporting could contribute to
lowering the substantial financial costs
of gun violence itself, which was
estimated at $174 billion in medical and
lost productivity expenses in 2010.42
However, we do not have information
about whether, or how many, covered
entities would begin to report or
increase reporting to the NICS as a
result of the rule, nor do we have a basis
for estimating the impact, if any, on the
financial costs associated with gun
violence.
An additional benefit of the rule is
that it provides clarity about the
applicability of the Privacy Rule and its
relationship to State law. Specifically,
the rule alleviates the concerns of State
lawmakers who, according to several
commenters on the ANPRM, may be
reluctant to pursue State legislation
requiring entities to report Federal
mental health prohibitor information for
NICS purposes because of a
misconception that the HIPAA Privacy
Rule would preempt such requirements.
As explained more fully above, the
Privacy Rule permits uses and
disclosures that are required by law, and
42 This comment cited Miller TR. The Cost of
Firearm Violence. Children’s Safety Network
Economics and Data Analysis Resource Center, at
Pacific Institute for Research and Evaluation,
December 2012.
E:\FR\FM\06JAR1.SGM
06JAR1
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
thus would not preempt a State law
requiring disclosures to NICS. However,
to the extent that State lawmakers
harbor this misconception, this
preamble clarifies HIPAA’s preemption
provisions and the final rule provides
an avenue for NICS reporting that may
obviate the need to enact legislation at
the State level.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The RFA requires agencies to analyze
and consider options for reducing
regulatory burden if a rule will impose
a significant burden on a substantial
number of small entities. The Act
requires the head of the agency either to
certify that the rule will not impose
such a burden or to perform a regulatory
flexibility analysis and consider
alternatives to lessen the burden. For
the reasons explained more fully above
in the summary of costs and benefits, it
is not expected that the rule will result
in compliance costs for covered entities
of any size because the rule does not
impose new requirements. Therefore,
the Secretary certifies that the rule will
not have a significant impact on a
substantial number of small entities.
2. Unfunded Mandates Reform Act
wgreen on DSK2VPTVN1PROD with RULES
Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipated
costs and benefits before issuing any
rule whose mandates would require
spending in any one year $100 million
in 1995 dollars, updated annually for
inflation. In 2013, that threshold is
approximately $141 million dollars.
UMRA does not address the total cost of
a rule. Rather, it focuses on certain
categories of cost, mainly those ‘‘Federal
mandate’’ costs resulting from: (1)
Imposing enforceable duties on State,
local, or Tribal governments, or on the
private sector; or (2) increasing the
stringency of conditions in, or
decreasing the funding of, State, local,
or Tribal governments under
entitlement programs. As this rule does
not impose enforceable duties or affect
entitlement programs, UMRA does not
require us to prepare an analysis of the
costs and benefits of the rule.
Nonetheless, we have done so in
accordance with Executive Orders
12866 and 13563, and present this
analysis in sections C and D above.
3. Federalism
Executive Order 13132 establishes
certain requirements that an agency
must meet when it promulgates a rule
that imposes substantial direct
requirement costs on State and local
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
governments, preempts State law, or
otherwise has Federalism implications.
The Federalism implications of the
HIPAA Privacy and Security Rules were
assessed as required by Executive Order
13132 and published as part of the
preambles to the final rules on
December 28, 2000 (65 FR 82462,
82797) and February 20, 2003 (68 FR
8334, 8373), respectively. This final rule
does not impose requirements, or any
associated costs, on State and local
governments. Regarding preemption, the
preamble to the final Privacy Rule
explained that the HIPAA statute
dictates the relationship between State
law and Privacy Rule requirements.
Therefore, the Privacy Rule’s existing
preemption provisions do not raise
Federalism issues, and these provisions
are not affected by this rule.
One commenter argued that a
permission for entities other than States
to report to the NICS would bypass the
decisions of the States regarding the
submission of reports and, therefore,
raises federalism implications. In
response, we again emphasize that this
rule does not require covered entities to
make disclosures that are prohibited by
State law, nor does it prevent
disclosures required by State law.
Further, States retain discretion to
determine which entities within the
State are authorized to report
information to the NICS. For these
reasons, the rule does not have
Federalism implications.
F. Accounting Statement
Whenever a rule is considered a
significant rule under Executive Order
12866, we are required to develop an
accounting statement indicating the
costs associated with the rule. As
explained above, we expect that the rule
is cost neutral. We did not receive
public comments on any unanticipated
costs associated with the rule, including
costs to covered entities that choose to
amend written HIPAA policies and
procedures or to provide additional
training to staff.
VII. Collection of Information
Requirements
This final rule does not contain
requests or requirements to report
information to the government, nor does
it impose new requirements for
recordkeeping or disclosures to thirdparties or the public. Therefore, the
requirements of the Paperwork
Reduction Act with respect to
information collections do not apply.
List of Subjects in 45 CFR Part 164
Administrative practice and
procedure, Computer technology,
PO 00000
Frm 00025
Fmt 4700
Sfmt 4700
395
Electronic information system,
Electronic transactions, Employer
benefit plan, Health, Health care, Health
facilities, Health insurance, Health
records, Hospitals, Medicaid, Medical
research, Medicare, Privacy, Reporting
and recordkeeping requirements, and
Security.
For the reasons set forth in the
preamble, the Department of Health and
Human Services amends 45 CFR
Subtitle A, Subchapter C, part 164, as
set forth below:
PART 164—SECURITY AND PRIVACY
1. The authority citation for part 164
continues to read as follows:
■
Authority: 42 U.S.C. 1302(a); 42 U.S.C.
1320d–1320d–9; sec. 264, Public Law 104–
191, 110 Stat. 2033–2034 (42 U.S.C. 1320d–
2(note)); and secs. 13400–13424, Public Law
111–5, 123 Stat. 258–279.
2. Amend § 164.512 by adding
paragraph (k)(7) to read as follows:
■
§ 164.512 Uses and disclosures for which
an authorization or opportunity to agree or
object is not required.
*
*
*
*
*
(k) * * *
(7) National Instant Criminal
Background Check System. A covered
entity may use or disclose protected
health information for purposes of
reporting to the National Instant
Criminal Background Check System the
identity of an individual who is
prohibited from possessing a firearm
under 18 U.S.C. 922(g)(4), provided the
covered entity:
(i) Is a State agency or other entity
that is, or contains an entity that is:
(A) An entity designated by the State
to report, or which collects information
for purposes of reporting, on behalf of
the State, to the National Instant
Criminal Background Check System; or
(B) A court, board, commission, or
other lawful authority that makes the
commitment or adjudication that causes
an individual to become subject to 18
U.S.C. 922(g)(4); and
(ii) Discloses the information only to:
(A) The National Instant Criminal
Background Check System; or
(B) An entity designated by the State
to report, or which collects information
for purposes of reporting, on behalf of
the State, to the National Instant
Criminal Background Check System;
and
(iii)(A) Discloses only the limited
demographic and certain other
information needed for purposes of
reporting to the National Instant
Criminal Background Check System;
and
E:\FR\FM\06JAR1.SGM
06JAR1
396
Federal Register / Vol. 81, No. 3 / Wednesday, January 6, 2016 / Rules and Regulations
(B) Does not disclose diagnostic or
clinical information for such purposes.
*
*
*
*
*
Dated: December 30, 2015.
Sylvia M. Burwell,
Secretary.
[FR Doc. 2015–33181 Filed 1–4–16; 4:15 pm]
BILLING CODE 4153–01–P
FEDERAL COMMUNICATIONS
COMMISSION
47 CFR Part 1
[GN Docket No. 12–268; WT Docket Nos.
14–70, 05–211; RM–11395; FCC 15–80]
Updating Competitive Bidding Rules
Federal Communications
Commission.
ACTION: Final rule; announcement of
effective date.
AGENCY:
In this document, the
Commission announces that on
December 10, 2015, the Office of
Management and Budget (OMB)
approved, on an emergency basis, for a
period for six months, a revision to an
approved information collection to
implement a modified collection
requirement under 47 CFR 1.2105(c)(4)
contained in the Part 1 Report and
Order, Updating Competitive Bidding
Rules, FCC 15–80. This document is
consistent with the Part 1 Report and
Order, which stated that the
Commission would publish a document
in the Federal Register announcing
OMB approval and the effective date of
the rule and requirement.
DATES: 47 CFR 1.2105(c)(4), published at
80 FR 56764 on September 18, 2015, is
effective on January 6, 2016.
FOR FURTHER INFORMATION CONTACT:
Contact Cathy Williams,
Cathy.Williams@fcc.gov, (202) 418–
2918.
SUMMARY:
This
document announces that, on December
10, 2015, OMB approved, on an
emergency basis, a revision to an
approved information collection to
implement a modified information
collection requirement under 47 CFR
1.2105(c)(4), published at 80 FR 56764
on September 18, 2015. The OMB
Control Number is 3060–0995. The
Commission publishes this document as
an announcement of the effective date of
the rule and requirement. If you have
any comments on the burden estimates
listed below, or how the Commission
can improve the collections and reduce
any burdens caused thereby, please
contact Cathy Williams, Federal
wgreen on DSK2VPTVN1PROD with RULES
SUPPLEMENTARY INFORMATION:
VerDate Sep<11>2014
13:07 Jan 05, 2016
Jkt 238001
Communications Commission, Room
1–C823, 445 12th Street SW.,
Washington, DC 20554. Please include
the OMB Control Number, 3060–0995,
in your correspondence. The
Commission will also accept your
comments via the Internet if you send
them to PRA@fcc.gov.
To request materials in accessible
formats for people with disabilities
(Braille, large print, electronic files,
audio format), send an email to fcc504@
fcc.gov or call the Consumer and
Governmental Affairs Bureau at (202)
418–0530 (voice), (202) 418–0432
(TTY).
Synopsis
As required by the Paperwork
Reduction Act of 1995 (44 U.S.C. 3507),
the Commission is notifying the public
that it received emergency approval
from OMB on December 10, 2015 for the
revised information collection
requirements contained in the
information collection 3060–0995,
Section 1.2105(c), Bidding Application
and Certification Procedures; Sections
1.2105(c) and Section 1.2205,
Prohibition of Certain Communications.
Under 5 CFR 1320, an agency may not
conduct or sponsor a collection of
information unless it displays a current,
valid OMB Control Number.
No person shall be subject to any
penalty for failing to comply with a
collection of information subject to the
Paperwork Reduction Act that does not
display a current, valid OMB Control
Number. The OMB Control Number is
3060–0995. The foregoing document is
required by the Paperwork Reduction
Act of 1995, Pub. L. 104–13, October 1,
1995, and 44 U.S.C. 3507.
The total annual reporting burdens
and costs for the respondents are as
follows:
OMB Control Number: 3060–0995.
OMB Approval Date: December 10,
2015.
OMB Expiration Date: June 30, 2016.
Title: Section 1.2105(c), Bidding
Application and Certification
Procedures; Sections 1.2105(c) and
Section 1.2205, Prohibition of Certain
Communications.
Form No.: N/A.
Respondents: Business or other forprofit entities; Not-for-profit
institutions; State, local or Tribal
government.
Number of Respondents and
Responses: 10 respondents; 10
responses.
Estimated Time per Response: 1.5
hours to 2 hours.
Frequency of Response: On occasion
reporting requirement.
Obligation to Respond: Required to
obtain or retain benefits. The statutory
PO 00000
Frm 00026
Fmt 4700
Sfmt 4700
authority for this information collection
is contained in sections 154(i), 309(j),
and 1452(a)(3) of the Communications
Act of 1934, as amended, 47 U.S.C. 4(i),
309(j)(5), and 1452(a)(3), and section
1.2105(c)(4) of the Commission’s rules,
47 CFR 1.2105(c)(4).
Total Annual Burden: 50 hours.
Total Annual Cost: $9,000.
Privacy Act Impact Assessment: No
impact(s).
Nature and Extent of Confidentiality:
The Commission will take all reasonable
steps to protect the confidentiality of all
Commission-held data of a reverse
auction applicant consistent with the
confidentiality requirements of the
Spectrum Act and the Commission’s
rules. See 47 U.S.C. 1452(a)(3); 47 CFR
1.2206. In addition, to the extent
necessary, a full power or Class A
television broadcast licensee may
request confidential treatment of any
report of a prohibited communication
submitted to the Commission that is not
already being treated as confidential
pursuant to section 0.459 of the
Commission’s rules. See 47 CFR 0.459.
Forward auction applicants are entitled
to request confidentiality in accordance
with section 0.459 of the Commission’s
rules, 47 CFR 0.459.
Needs and Uses: In the Broadcast
Incentive Auction Report and Order,
Expanding the Economic and
Innovation Opportunities of Spectrum
Through Incentive Auctions, FCC 14–
50, the Commission adopted a new rule
for forward auction applicants
prohibiting certain communications in
the context of the television broadcast
incentive auction (BIA), and amended
an existing rule to require forward
auction applicants that make or receive
a communication that is prohibited
under the new rule to file a report of
such a communication with the
Commission. See 47 CFR 1.2105(c)(4),
1.2105(c)(6). Subsequently, as a result of
amendments to various other provisions
in section 1.2105(c) adopted in the Part
1 Report and Order, the new rule for
forward auction applicants prohibiting
certain communications in the context
of the BIA and the amended reporting
requirement for forward auction
applicants were redesignated as
1.2105(c)(4) and 1.2105(c)(6),
respectively, without any changes to the
scope or substance of either rule. See 47
CFR 1.2105(c)(4), 1.2105(c)(6). The
Commission’s rules prohibiting certain
communications in Commission
auctions are designed to reinforce
existing antitrust laws, facilitate
detection of collusive conduct, and
deter anticompetitive behavior, without
being so strict as to discourage
procompetitive arrangements between
E:\FR\FM\06JAR1.SGM
06JAR1
]]>Agencies
[Federal Register Volume 81, Number 3 (Wednesday, January 6, 2016)]
[Rules and Regulations]
[Pages 382-396]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2015-33181]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Part 164
Health Insurance Portability and Accountability Act (HIPAA)
Privacy Rule and the National Instant Criminal Background Check System
(NICS)
AGENCY: Office for Civil Rights, Department of Health and Human
Services.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Health and Human Services (HHS or ``the
Department'') is issuing this final rule to modify the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to
expressly permit certain HIPAA covered entities to disclose to the
National Instant Criminal Background Check System (NICS) the identities
of individuals who are subject to a Federal ``mental health
prohibitor'' that disqualifies them from shipping, transporting,
possessing, or receiving a firearm. The NICS is a national system
maintained by the Federal Bureau of Investigation (FBI) to conduct
background checks on persons who may be disqualified from receiving
firearms based on Federally prohibited categories or State law. Among
the persons subject to the Federal mental health prohibitor established
under the Gun Control Act of 1968 and implementing regulations issued
by the Department of Justice (DOJ) are individuals who have been
involuntarily committed to a mental institution; found incompetent to
stand trial or not guilty by reason of insanity; or otherwise have been
determined by a court, board, commission, or other lawful authority to
be a danger to themselves or others or to lack the mental capacity to
contract or manage their own affairs, as a result of marked subnormal
intelligence or mental illness, incompetency, condition, or disease.
Under this final rule, only covered entities with lawful authority to
make the adjudications or commitment decisions that make individuals
subject to the Federal mental health prohibitor, or that serve as
repositories of information for NICS reporting purposes, are permitted
to disclose the information needed for these purposes. The disclosure
is restricted to limited demographic and certain other information
needed for NICS purposes. The rule specifically prohibits the
disclosure of diagnostic or clinical information, from medical records
or other sources, and any mental health information beyond the
indication that the individual is subject to the Federal mental health
prohibitor.
DATES: Effective date: This final rule is effective on February 5,
2016.
FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.
SUPPLEMENTARY INFORMATION:
I. Background
On January 16, 2013, President Barack Obama announced 23 executive
actions aimed at curbing gun violence across the nation. Those actions
include efforts by the Federal government to strengthen the national
background check system, and a specific commitment to ``[a]ddress
unnecessary legal barriers, particularly relating to the Health
Insurance Portability and Accountability Act, that may prevent States
from making information available to the background check system.'' The
National Instant Criminal Background Check System (NICS) is the system
used to determine whether a potential firearms recipient is statutorily
prohibited from possessing or receiving a firearm. The Department
proposed, and now finalizes, a modification to the HIPAA Privacy Rule
to permit certain covered entities to disclose to the NICS the
identities of persons who are not allowed to possess or receive a
firearm because they are subject to the Federal mental health
prohibitor.
The National Instant Criminal Background Check System (NICS)
The Brady Handgun Violence Prevention Act of 1993, Public Law 103-
159 (Brady Gun Law), and its implementing regulations, are designed to
prevent the transfer of firearms by licensed dealers to individuals who
are not allowed to possess or receive them as a result of restrictions
contained in either the Gun Control Act of 1968, as amended (Title 18,
United States Code, Chapter 44), or State law. The Gun Control Act
identifies several categories (known as ``prohibitors'') of individuals
\1\ who are prohibited from engaging in the shipment, transport,
receipt, or possession of firearms, including convicted felons and
fugitives. Most relevant for the purposes of this rule is the Federal
mental health prohibitor, which, pursuant to Department of Justice
(DOJ) regulations, applies to individuals who have been involuntarily
committed to a mental institution, for reasons such as mental illness
or drug use; \2\ found incompetent to stand trial or not guilty by
reason of insanity; or otherwise determined by a court, board,
commission, or other lawful authority to be a danger to themselves or
others or unable to manage their own affairs, as a result of marked
subnormal intelligence, or mental illness, incompetency, condition, or
disease.3 4
---------------------------------------------------------------------------
\1\ See 18 U.S.C. 922(g) and (n) and implementing regulations at
27 CFR 478.11 and 27 CFR 478.32.
\2\ The regulation, at 27 CFR 478.11, defines ``Committed to a
mental institution'' as a formal commitment to the institution by a
court or other lawful authority. The term does not apply to a person
voluntarily admitted to a mental institution or in a mental
institution merely for observation.
\3\ The term used in the statute is ``adjudicated as a mental
defective. The term includes a finding of insanity in a criminal
case, and a finding of incompetence to stand trial or a finding of
not guilty by reason of lack of mental responsibility pursuant to
the Uniform Code of Military Justice. 27 CFR 478.11.
\4\ This rule refers to the involuntary commitments and other
applicable adjudications as, collectively, ``adjudications that make
an individual subject to the Federal mental health prohibitor.''
---------------------------------------------------------------------------
The Brady Gun Law established the NICS to help enforce these
prohibitions, as well as State law prohibitions on the possession or
receipt of firearms.\5\ The NICS Index, a database administered by the
Federal Bureau of Investigation (FBI), collects and maintains certain
identifying information about individuals who are subject to one or
more Federal prohibitors and thus who are ineligible to purchase
firearms. As of 2012, the NICS Index also contains information on
persons who are subject to State law prohibitions on the possession or
receipt of firearms.\6\ The
[[Page 383]]
minimum information required in a NICS Index record consists of: The
name of the ineligible individual; the date of birth; sex; and codes
indicating the applicable prohibitor, the submitting entity, and the
agency record supporting the prohibition (e.g., an order for
involuntary commitment). For individuals subject to the Federal mental
health prohibitor, only the fact that the individual is subject to that
prohibitor is submitted to the NICS; underlying diagnoses, treatment
records, and other identifiable health information are not provided to
or maintained by the NICS. A NICS background check queries the NICS
Index and certain other national databases \7\ to determine whether a
prospective buyer's identifying information matches any prohibiting
records contained in the databases. The NICS Index can be accessed only
for the limited purposes authorized by regulation (see 28 CFR 25.6(j))
and cannot be used for other purposes, including general law
enforcement activities.
---------------------------------------------------------------------------
\5\ See Public Law 103-159, 18 U.S.C. 921-925, and implementing
regulations at 28 CFR 25.1 through 25.11 (establishing NICS
information system specifications and processes) and 27 CFR part 478
(establishing requirements and prohibitions for commerce in firearms
and ammunition, including requirements related to conducting NICS
background checks); and 42 U.S.C. 3759(b) (allocating a percentage
of certain DOJ funds for State reporting of NICS data).
\6\ See Statement Before the Senate Judiciary Committee,
Subcommittee on Crime and Terrorism at a hearing entitled, ``THE FIX
GUN CHECKS ACT: BETTER STATE AND FEDERAL COMPLIANCE, SMARTER
ENFORCEMENT'' (November 15, 2011), by David Cuthbertson, Assistant
Director, Criminal Justice Information Services Division, Federal
Bureau of Investigation. Testimony available at: https://www.justice.gov/ola/testimony/112-1/11-15-11-fbi-cuthbertson-testimony-re-the-fix-gun-checks-act.pdf. We note also that State law
may be more restrictive than Federal law in some cases.
\7\ The other databases include the Interstate Identification
Index, which contains criminal history record information; and the
National Crime Information Center, which includes, e.g., information
on persons subject to civil protection orders and arrest warrants.
Additional information is available at, https://www.fbi.gov/about-us/cjis/nics/general-information/nics-overview.
---------------------------------------------------------------------------
The potential transfer of a firearm from a Federal Firearms
Licensee (FFL) to a prospective buyer proceeds as follows: First, the
prospective buyer is required to provide personal information on a
Firearms Transaction Record (ATF Form 4473). Unless the prospective
buyer has documentation that he or she qualifies for an exception to
the NICS background check requirement under 18 U.S.C. 922(t)(3),\8\ the
FFL contacts the NICS--electronically, by telephone, or through a State
level point of contact--and provides certain identifying information
about the prospective buyer from ATF Form 4473.\9\
---------------------------------------------------------------------------
\8\ These exceptions are listed in the Bureau of Alcohol,
Tobacco, Firearms and Explosives (ATF) regulation at 27 CFR
478.102(d). For example, a NICS check would not be required where
the potential recipient of a firearm has presented a valid State
permit or license, provided conditions at 27 CFR 478.102(d)(1) are
met.
\9\ The form collects the prospective buyer's name; demographic
information such as address, place and date of birth, gender,
citizenship, race and ethnicity; and ``yes'' or ``no'' answers to
questions about the person's criminal history and other potential
prohibitors. The form is available at https://www.atf.gov/forms/download/atf-f-4473-1.pdf.
---------------------------------------------------------------------------
The FFL then receives a response that the prospective firearm
transfer may proceed or is delayed. The transfer is delayed if the
prospective buyer's information matches a record contained in one of
the databases reviewed. If there is a match, a NICS examiner reviews
the record to determine whether the information it contains is, in
fact, prohibiting, and then either: (1) If the record does not contain
prohibiting information, advises the FFL to proceed with the
transaction; (2) if the record does contain prohibiting information,
denies the transaction (due to ineligibility); or (3) if it is unclear
based solely on the existing information in the record whether it is
prohibiting, delays the transaction pending further research.\10\ The
NICS examiner does not disclose the reason for the determination to the
FFL (e.g., the FFL would not learn that the individual was ineligible
due to the Federal mental health prohibitor). In case of a delay, if
the NICS examiner does not provide a final instruction to the FFL
within three business days of the initial background check request, the
FFL may proceed with the transaction.\11\
---------------------------------------------------------------------------
\10\ For example, a ``delay'' response may mean that further
research is required because potentially prohibitive criteria exist,
but the matched records are incomplete, See Federal Bureau of
Investigation (FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
\11\ Some States have waiting periods that also must be complied
with before a firearm may be transferred, regardless of whether a
proceed response from NICS is received by the FFL within three
business days.
---------------------------------------------------------------------------
Although FFLs are required in most cases to request a background
check through the NICS before transferring a firearm to a prospective
buyer,\12\ Federal law does not require State agencies to report to the
NICS the identities of individuals who are prohibited from purchasing
firearms under either Federal or State prohibitors, and not all States
report complete information to the NICS or the databases checked by it.
Following the shooting at Virginia Tech University in 2007, and other
tragedies involving the illegal use of firearms, Congress enacted the
NICS Improvement Amendments Act (NIAA) of 2007, Public Law 110-180.
Among other provisions, the NIAA requires Federal agencies to make
accessible to the NICS the identities of individuals known by the
agencies to be subject to one or more prohibitors, and it authorizes
incentive grants for States to provide such information when it is in
their possession.\13\ In addition, some States have enacted legislation
requiring the reporting of the identities of ineligible individuals to
databases accessible to the NICS or to a State level repository
responsible for submitting information to the relevant databases.
---------------------------------------------------------------------------
\12\ See 27 CFR 478.102. Exceptions to this requirement are
referenced in FN 8 above, and listed in the regulation at 27 CFR
478.102(d).
\13\ Eligibility for these grants is limited to States that have
implemented a ``relief from disabilities'' program for individuals
who are prohibited from possessing or receiving firearms for mental
health reasons. Such programs must provide that a State court,
board, commission, or other lawful authority shall grant the relief
if, based on the circumstances regarding the disabilities and the
person's record and reputation, the person is not likely to pose a
danger to public safety, and granting the relief would not be
contrary to the public interest. See Public Law 110-180, Section
105.
---------------------------------------------------------------------------
States generally report criminal history information to the other
relevant databases that are checked by the NICS; however, many States
continue to report little if any information concerning individuals
subject to the Federal mental health prohibitor (or the other Federal
prohibitors) to the NICS Index.\14\ As a result, the NICS does not have
access to complete information about all individuals who are subject to
one or more of the Federal prohibited categories or who are prohibited
from possessing or receiving firearms under State law.
---------------------------------------------------------------------------
\14\ Federal law does not require States to submit reports to
any of the three databases (the NICS Index, the III, and NCIC)
accessed during a NICS Check.
---------------------------------------------------------------------------
The HIPAA Privacy Rule and NICS Reporting
The Privacy Rule, promulgated under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle
F--Administrative Simplification, Public Law 104-191, establishes
federal protections to ensure the privacy and security of protected
health information (PHI) and establishes an array of individual rights
with respect to one's own health information. HIPAA applies to covered
entities, which include health plans, health care clearinghouses, and
health care providers that conduct certain standard transactions (such
as billing insurance) electronically. HIPAA covered entities may only
use and disclose PHI with the individual's written authorization, or as
otherwise expressly permitted or required by the HIPAA Privacy Rule.
The Privacy Rule seeks to balance individuals' privacy interests
with important public policy goals including public health and safety.
In doing so, the Privacy Rule allows, subject to certain conditions and
limitations, uses and disclosures of PHI without individuals'
authorization for certain law enforcement purposes, to avert a serious
threat to health or safety, and where required by State or other law,
among other purposes.\15\
---------------------------------------------------------------------------
\15\ See 45 CFR 164.512.
---------------------------------------------------------------------------
[[Page 384]]
As stated above, individuals who are subject to the Federal mental
health prohibitor are ineligible to purchase a firearm because they
have been ``committed to a mental institution'' or ``adjudicated as a
mental defective.'' \16\ DOJ regulations define these categories to
include persons who have been involuntarily committed to a mental
institution for reasons such as mental illness or drug use; have been
found incompetent to stand trial or not guilty by reason of insanity;
or otherwise have been determined by a court, board, commission, or
other lawful authority to be a danger to themselves or others or unable
to manage their own affairs, as a result of marked subnormal
intelligence, or mental illness, incompetency, condition, or disease.
In many cases, these records are not subject to HIPAA. Records of
individuals adjudicated as incompetent to stand trial, or not guilty by
reason of insanity, originate with entities in the criminal justice
system, and these entities are not HIPAA covered entities. Likewise,
involuntary civil commitments usually are made by court order, and
thus, records of such formal commitments typically originate with
entities in the justice system. In addition, many adjudications
determining that individuals are a danger to themselves or others, or
are incapable of managing their own affairs, occur through a legal
process in the court system.
---------------------------------------------------------------------------
\16\ See 18 U.S.C. 922(g)(4).
---------------------------------------------------------------------------
However, because of the variety of State laws, there may be State
agencies, boards, commissions, or other lawful authorities outside the
court system that are involved in some involuntary commitments or
mental health adjudications that make an individual subject to the
Federal mental health prohibitor. Moreover, we understand that some
States have designated repositories to collect and report to the NICS
the identities of individuals subject to the Federal mental health
prohibitor. We believe that certain of these lawful authorities or
repositories also may be HIPAA covered entities (e.g., a State health
agency may be a covered entity).
As we described in the NPRM, where the record of an involuntary
commitment or mental health adjudication originates with a HIPAA
covered entity, or the HIPAA covered entity is the State repository for
such records, there are two ways in which covered entities can
currently report to the NICS (without the individual's authorization).
First, a covered entity can disclose the relevant information to the
NICS where a State has enacted a law that requires (and does not merely
authorize) such reporting.\17\ Second, where a State has not enacted
such a law, a HIPAA covered entity that performs both health care and
non-health care functions (e.g., NICS reporting) could become a hybrid
entity under HIPAA so that the Privacy Rule applies only to its health
care functions. A covered entity can achieve hybrid entity status by
designating its health care components as separate from other
components, documenting the designation, and implementing policies and
procedures to prevent unauthorized access to PHI by the entity's non-
covered components.\18\ Under these circumstances, the covered entity
can report prohibitor information through its non-HIPAA covered NICS
reporting unit without restriction under the Privacy Rule. These
provisions remain in effect and are not altered by the amendments to
the Privacy Rule that we issue today.
---------------------------------------------------------------------------
\17\ See 45 CFR 164.512(a). Note that disclosures for NICS
purposes would not fall under the Privacy Rule's provisions
permitting disclosures for law enforcement purposes (which apply to
specific law enforcement inquiries) or to avert a serious threat to
health or safety (which require an imminent threat of harm). See 45
CFR 164.512(f) and (j).
\18\ See 45 CFR 164.103, 164.105; 67 FR 53182 (8/14/2002).
---------------------------------------------------------------------------
However, despite these avenues for disclosure, many States still
were not reporting to the NICS essential information on persons
prohibited from possessing firearms for reasons related to mental
health; concerns were raised that the HIPAA Privacy Rule's restrictions
on covered entities' disclosures of PHI might be preventing certain
States from reporting the relevant information to the NICS.
In addition, in July 2012, the U.S. Government Accountability
Office (GAO) reported to Congress on the results of a survey of six
States that it had assessed as part of a performance audit of the
progress made by DOJ and the States in implementing the NIAA.\19\ In
the report, the GAO wrote that ``officials from 3 of the 6 States we
reviewed said that the absence of explicit State-level statutory
authority to share mental health records was an impediment to making
such records available to NICS.'' \20\ The report also stated that,
although the number of records provided by the States to the NICS had
increased by 800 percent between 2004 and 2011, this increase was
largely due to efforts by only 12 States. The report raised the
possibility that States that do not report to the NICS the identities
of individuals who are prohibited from possessing firearms for reasons
related to mental health may experience challenges to reporting related
to the HIPAA Privacy Rule.
---------------------------------------------------------------------------
\19\ See GAO-12-684, Gun Control: Sharing Promising Practices
and Assessing Incentives Could Better Position Justice to Assist
States in Providing Records for Background Checks.
\20\ We note that the GAO Report uses the term ``mental health
records'' to refer to identifying information on individuals who are
subject to the Federal mental health prohibitor. To avoid implying
that mental health records are collected by NICS, the Department
uses the terms ``identities,'' ``information,'' or ``data'' in place
of ``mental health records.'' GAO-12-684, p. 12.
---------------------------------------------------------------------------
II. The ANPRM
Background
On April 23, 2013, the Department published an Advance Notice of
Proposed Rulemaking (ANPRM) requesting public input on these issues (78
FR 23872). The ANPRM explained that the Department was considering
creating an express permission in the HIPAA Privacy Rule for reporting
information relevant to the Federal mental health prohibitor to the
NICS by those HIPAA covered entities that (a) are responsible for the
involuntary commitments or other adjudications that make individuals
subject to the Federal mental health prohibitor, or (b) are designated
by a State to report to the NICS. In the ANPRM, the Department
indicated that such an amendment might produce clarity regarding the
Privacy Rule and help make it simpler for States to report the
identities of such individuals to the NICS.
To inform our efforts to address any issues in this area, we
requested comments on a series of questions concerning the nature and
scope of the problem of underreporting and whether a modification to
the Privacy Rule would help address these issues. We also requested
comments on any implications of a modification to the Privacy Rule for
the mental health community or for the treatment of individuals, and
how the Department might address any unintended consequences of such a
modification. We received over 2,050 comments in response from
individuals, State agencies, health care providers, associations of
health care professionals, consumer advocacy groups, and other
stakeholders.
A number of commenters supported creating an express permission as
a way to remove a potential barrier to an important and necessary
public safety measure, which could help keep firearms out of the hands
of individuals who should not have them by strengthening the background
check system. Many others generally expressed concern that the NICS,
the Federal mental health prohibitor, and
[[Page 385]]
the contemplated HIPAA permission would infringe on their Second
Amendment right to bear arms and the right to be afforded due process
of law under the U.S. Constitution. In addition, many individual
commenters, as well as health care providers, organizations
representing providers, and consumer advocacy groups, emphasized the
importance of protecting individuals' health information privacy. These
commenters raised concerns regarding the possible adverse consequences
an express permission to report certain information could have on the
patient-provider treatment relationship and individuals' willingness to
seek needed mental health care.\21\
---------------------------------------------------------------------------
\21\ Please see the ANPRM for a more thorough discussion of
public comments and responses. 78 FR 23872 (April 23, 2013).
---------------------------------------------------------------------------
III. Summary of the NPRM
After considering the public comments received on the ANPRM, we
published a Notice of Proposed Rulemaking (NPRM) on January 7,
2014,\22\ proposing to use the Department's broad authority under HIPAA
to specify the permitted uses and disclosures of PHI by HIPAA covered
entities. The NPRM proposed to revise 45 CFR 164.512 of the Privacy
Rule by adding a new category of permitted disclosures to 45 CFR
164.512(k), which addresses uses and disclosures for specialized
government functions. The NPRM proposed new provisions at (k)(7) that
would permit certain covered entities to disclose the limited
demographic and certain other information needed for NICS reporting
purposes.
---------------------------------------------------------------------------
\22\ See 79 FR 784 (January 7, 2014).
---------------------------------------------------------------------------
We indicated in the NPRM that there is a strong public safety need
for this information to be accessible to the NICS and that some States
are currently under-reporting or not reporting this information at all.
Further, although most of the information relevant to the Federal
mental health prohibitor is held by entities that are not covered by
HIPAA, for those few HIPAA covered entities that may be involved in the
relevant commitments or adjudications, the Privacy Rule's existing
paths for disclosure did not appear to be sufficient. We explained
that, to the extent that some covered entities perform adjudicatory or
repository functions in States that have not enacted laws requiring
reporting to the NICS, and that a subset of those may be unable to
achieve hybrid entity status due to administrative challenges or other
reasons, an express permission would provide clarity and remove a
barrier to their reporting.
However, to address concerns regarding an express permission's
potential to harm the patient-provider relationship or deterring
individuals from seeking needed mental health care, we proposed to
narrowly tailor the permission to report information on individuals
subject to the Federal mental health prohibitor in a number of ways.
Specifically, we proposed to limit: (1) Which covered entities could
use or disclose PHI for NICS reporting purposes, (2) to whom the PHI
could be disclosed, and (3) the scope of the information that could be
used or disclosed.
First, the NPRM proposed a new paragraph at 164.512(k)(7)(i) to
permit certain NICS disclosures only by those covered entities that
function as repositories of information relevant to the Federal mental
health prohibitor on behalf of a State or that are responsible for
ordering the involuntary commitments or other adjudications that make
an individual subject to the Federal mental health prohibitor. The
Federal prohibitor regulations define an involuntary commitment as a
formal commitment of a person to a mental institution by a court,
board, commission, or other lawful authority. The other applicable
adjudications include determinations by a court, board, commission, or
other lawful authority that persons are a danger to themselves or
others, or lack the mental capacity to contract or manage their own
affairs, as a result of marked subnormal intelligence, or mental
illness, incompetency, condition, or disease.\23\ The prohibitor does
not apply to individuals in a psychiatric facility for observation or
who have been admitted voluntarily; thus, the proposed rule would not
have permitted disclosures with respect to those individuals.
---------------------------------------------------------------------------
\23\ See 27 CFR 478.11 (Definitions).
---------------------------------------------------------------------------
With respect to repositories of Federal mental health prohibitor
information, we explained further that we did not intend to require
States to formally designate the entities responsible for NICS
reporting, but that we would expect States to be able to identify the
relevant entities.
We noted in the NPRM that our understanding was that lawful
authority for performing such adjudications and repository functions
rests, for the most part, with entities that operate outside the scope
of HIPAA. However, in the interest of public safety, we wanted to
ensure that relevant adjudications could be reported in the subset of
States in which HIPAA covered entities may make, or collect and report
records of, these determinations.
We explained further that, in permitting only entities involved in
these adjudicatory or repository/reporting functions to use or disclose
Federal mental health prohibitor information for NICS purposes, the
proposal would not create a permission for most treating providers to
disclose PHI about their own patients for these purposes. We agreed
with the commenters on the ANPRM who argued that encouraging voluntary
treatment is critical to ensuring positive outcomes for individuals'
health as well as the public's safety, and explained that the NPRM was
designed to balance that goal and the public safety interests served by
the NICS. We also agreed that non-health care entities bear primary
responsibility for collection and reporting of information relevant to
the Federal mental health prohibitor in most States. However, where a
HIPAA covered entity is a board, commission, or other lawful authority
that makes involuntary commitments or other adjudications that result
in individuals being subject to the Federal mental health prohibitor,
we believed those entities too were likely to hold records of the
relevant commitments and adjudications.
We requested public comment on the extent to which some States may
have vested responsibility for Federal mental health prohibitor
reporting in HIPAA covered entities, to what extent records needed for
NICS reporting are created or maintained by covered entities, and
whether there are circumstances in which health care providers would
need to report the identity of an individual subject to the Federal
mental health prohibitor to a State designated records repository or
directly to the NICS. We also requested comment on the types of
additional guidance from OCR and/or the NICS that would be helpful for
understanding to which covered entities, and under what circumstances,
the proposed permission would apply.
Second, we proposed a new paragraph at (k)(7)(ii) providing that a
covered entity identified in (k)(7)(i) may use or disclose Federal
mental health prohibitor information for NICS purposes only directly to
the NICS or to an entity designated by the State as a repository of
data for purposes of reporting to the NICS. By clearly delimiting the
permitted recipients of such disclosures, we explained that the rule
would ensure that covered entities do not exceed the intended scope of
the permission by disclosing information relevant to the Federal mental
health
[[Page 386]]
prohibitor to, for example, law enforcement agencies that do not
operate as repositories of data for purposes of reporting to the
NICS.\24\ We requested comment on whether there are States in which a
type of entity not described in this proposed paragraph is responsible
for NICS reporting and thus, should be able to receive NICS data from a
HIPAA covered entity.
---------------------------------------------------------------------------
\24\ We did not propose to change the Privacy Rule's existing
permissions to use or disclose PHI for specific law enforcement
investigations, as provided in 45 CFR 164.512(f).
---------------------------------------------------------------------------
Third, we proposed a new paragraph at (k)(7)(iii) to limit the
information permitted to be used or disclosed to what is needed for
purposes of reporting to the NICS. This is consistent with the Privacy
Rule provision that generally requires covered entities to make
reasonable efforts to limit the PHI used or disclosed to the minimum
necessary to accomplish the intended purpose. Specifically, in the
proposed regulation text, we made clear that only the limited
demographic and certain other information needed for purposes of
reporting to the NICS could be reported under the permission. We
indicated that, at the time, we believed that the necessary information
would be the data elements needed to create a NICS Index record: (1)
Name of the individual; (2) date of birth; (3) sex; (4) a code or
notation indicating that the individual is subject to the Federal
mental health prohibitor; (5) a code or notation representing the
reporting entity; and (6) a code identifying the agency record
supporting the prohibition. The proposed regulation text expressly
provided that the proposed modification would not permit the use or
disclosure of clinical or diagnostic information for NICS reporting
purposes. We requested comment on whether, and in what circumstances,
HIPAA covered entities or other entities, such as courts, currently
report to a records repository or directly to the NICS information that
was not listed in the proposed paragraph.
In addition, we explained that we were also considering permitting
the disclosure of some or all the following additional data elements,
which are optional fields for a NICS Index entry, for NICS reporting
purposes: Social Security number, place of birth, State of residence,
height, weight, eye color, hair color, and race. As we noted in the
NPRM, from what we understand, these elements are not included in every
NICS record, but often are used to confirm that a prospective firearm
recipient matches a record searched by the NICS or to eliminate ``false
positive'' background check results. We requested public comment on
this issue.
We also proposed to limit the permission to uses and disclosures
about individuals who are subject to the Federal mental health
prohibitor and not to apply it to disclosures about individuals subject
only to State mental health prohibitors. However, we requested comment
on this aspect of the scope of the permission, specifically with regard
to whether the permission should be broadened to allow covered entities
to also disclose the identities of individuals who are prohibited by
State law from possessing or receiving firearms for reasons related to
mental health.
Finally, we also explained that the proposed permission would apply
only with respect to the PHI of individuals subject to the Federal
mental health prohibitor and not to the PHI of those persons who may be
subject to the other Federal prohibitors listed at 18 U.S.C. 922(g).
The lack of an express HIPAA permission for reporting information
relevant to the Federal mental health prohibitor was a limited problem
and we had not heard that there was a similar issue with respect to the
other prohibitors. Thus, for example, a covered entity would not be
able to use the proposed permission to use or disclose information
about an individual who is an unlawful user of or addicted to any
controlled substance (18 U.S.C. 922(g)(3)), except to the extent the
individual was also subject to the Federal mental health prohibitor. We
also noted that other laws could impact disclosures related to the
other Federal prohibitors, including 18 U.S.C. 922(g)(3).\25\
---------------------------------------------------------------------------
\25\ The ability of certain entities to report individuals who
are subject to the Federal prohibitor at 18 U.S.C. 922(g)(3) may be
affected by the Confidentiality of Alcohol and Drug Abuse Patient
Records Regulations, 42 CFR part 2, administered by the Substance
Abuse and Mental Health Services Administration (SAMHSA).
---------------------------------------------------------------------------
IV. Provisions of the Final Regulation
This final rule adopts the modifications to the HIPAA Privacy Rule
as proposed. After considering the comments we received, we continue to
believe that the creation of a limited express permission in the HIPAA
Privacy Rule to use or disclose certain information relevant to the
Federal mental health prohibitor for NICS purposes is necessary to
address barriers related to HIPAA and to ensure that relevant
information can be reported for this important public safety purpose.
Furthermore, this narrowly tailored rule appropriately balances public
safety goals with important patient privacy interests to ensure that
individuals are not discouraged from seeking voluntary treatment.
Under this final rule, covered entities that order involuntary
commitments or make other adjudications that subject individuals to the
Federal mental health prohibitor, or that serve as repositories of the
relevant data, are permitted to use or disclose the information needed
for NICS reporting of such individuals either directly to the NICS or
to a State repository of NICS data. Thus, if a covered health care
entity also has a role in the relevant mental health adjudications or
serves as a State data repository, it now may disclose the relevant
information for NICS reporting purposes under this new permission even
if it is not designated as a HIPAA hybrid entity or required by State
law to report. This final rule does not create an express permission
for covered entities to disclose for NICS reporting purposes the PHI of
individuals who are subject to State-only mental health prohibitors.
The Department's rationale for adopting the provisions in this
final rule, along with further clarifications and interpretations of
the provisions, is explained below in the responses to the public
comments on the NPRM.
V. Analysis of and Responses to Public Comments
We received more than 430 public comments in response to the NPRM,
including from advocacy organizations, associations of health care and
mental health professionals, a state mental health agency, and
individual members of the public. A summary of the comments we received
on the proposed rule and our responses follow.
A. Comments Regarding Creating an Express Permission for NICS Reporting
in the HIPAA Privacy Rule
Comments: A number of commenters expressed general support for
including an express permission in the HIPAA Privacy Rule for reporting
certain information to the NICS, stating that the rule change would
help increase the reporting of information to the NICS, reduce the
ability of individuals with serious mental health problems to obtain
firearms, and ultimately lessen the risk of harm to the individuals
themselves, law enforcement, and the public.
Several advocacy organizations involved in gun violence prevention
agreed with our statements in the NPRM that the HIPAA Privacy Rule and,
in some cases, perceptions of the Privacy Rule, may create a barrier to
certain entities reporting to the NICS, and that the proposed
modification would
[[Page 387]]
address this problem. For example, the comment submitted by Mayors
Against Illegal Guns (MAIG) indicated that mental health treatment
facilities in seven States currently are required by State law to
report Federal mental health prohibitor information either directly to
the NICS or to State agencies that report to the NICS, which indicates
that mental health facilities do in some cases hold the relevant
records. MAIG inferred from this information that there likely are
other States in which HIPAA covered entities have information that
should be reported to the NICS, but that the entities may not be
reporting due to concerns about the HIPAA Privacy Rule's restrictions
on disclosures. MAIG also cited statements from interviews its
researchers conducted with State officials about issues related to NICS
reporting and noted that officials from nine States and the District of
Columbia had expressed concern that HIPAA, or other privacy
requirements, generally prohibited sending records to the NICS, and
thus that reporting would violate such requirements. MAIG asserted that
whether these cited concerns were based on real or perceived barriers,
its research indicated that making clear the ability to report without
violating privacy laws tended to greatly improve state reporting rates,
and that the proposed modifications to the Privacy Rule similarly would
help states improve their record submissions.\26\
---------------------------------------------------------------------------
\26\ MAIG, Fatal Gaps, How Missing Records in the Federal
Background Check System Put Guns in the Hands of Killers (Nov.
2011).
---------------------------------------------------------------------------
A number of commenters asserted that increasing reporting to the
NICS could, in turn, help to decrease rates of gun violence. One of
these commenters cited research indicating that, in one State, having a
mental health adjudication record in the NICS database appeared to
reduce the chance of a person committing a first violent crime.\27\
---------------------------------------------------------------------------
\27\ The commenter cited Jeffrey Swanson, Preventing Gun
Violence Involving People with Serious Mental Illness in REDUCING
GUN VIOLENCE IN AMERICA, INFORMING POLICY WITH EVIDENCE AND ANALYSIS
(eds. Daniel W. Webster and Jon S. Vernick, 2013). The study authors
note that, ``[c]onsidering separately the subgroup of people with
serious mental illness who do not have criminal records, our data
seem to suggest that the Brady Law background checks can have some
positive effect, if enforced. In those with a gun-disqualifying
mental health record, risk of violent criminal offending declined
significantly after Connecticut began reporting gun-disqualifying
mental health records to the NICS.'' The authors also describe the
limitations of the study and add, ``[t]hese findings do not prove a
causal relationship between the background check system and reduced
violent crime.''
---------------------------------------------------------------------------
In addition, a number of commenters, including the American Medical
Association (AMA), and the American Psychiatric Association (APA),
expressed appreciation that the proposed rule would appropriately
balance protecting public safety and preserving the patient-physician
relationship by narrowly defining the scope of the permission. The AMA
stated that its view on the issue of reporting patient information to
the NICS is governed by the association's Code of Medical Ethics and
policies adopted by the AMA's policy making body. The AMA indicated
that the Code of Ethics supports strong protections for patient privacy
and, in most cases, requires physicians to keep patient medical records
strictly confidential. If there must be a breach in confidentiality,
such as for public health or safety reasons, the disclosures must be as
narrow in scope as possible. In light of these considerations, the AMA
expressed support for the Department's approach.
In contrast, many commenters did not support adding an express
permission in the HIPAA Privacy Rule for reporting certain information
about persons subject to the Federal mental health prohibitor for NICS
purposes. Several commenters asserted that there are only ``perceived
barriers'' related to HIPAA, not real ones, so changing HIPAA would be
unlikely to increase the reporting of mental health prohibitor
information for NICS purposes. One commenter suggested that, rather
than facing obstacles to reporting, States may be choosing not to
report on certain categories of prohibited individuals for reasons
unrelated to HIPAA--for example, because the States do not believe the
individuals pose a danger.
Other comments, some of which highlighted the importance of early
and appropriate mental health intervention as the most effective way to
prevent violence related to mental illness, expressed concern that the
proposed permission would discourage individuals from seeking needed
treatment. For example, the National Association of Psychiatric Health
Systems (NAPHS) predicted that the public perception of the proposed
rule would be that, if an individual disclosed information to a
therapist, the therapist would be required to ``report'' the patient.
This commenter argued that, as a result, the proposed rule would create
a chilling effect on individuals' willingness to discuss issues in
treatment that could lead to positive resolution rather than violence
directed toward themselves or others. A number of commenters also
expressed concern that the proposed rule would unfairly target persons
with mental illness and perpetuate unfounded and damaging stereotypes
about persons with mental illness by sending a message to the public
that the Department perceives mental illness as inextricably linked
with violence.
Some commenters expressed general concern regarding the effects of
the proposed rule on individuals' privacy interests. A number of these
commenters argued that communications between patients and their health
care providers should be kept confidential under all circumstances.
Response: After considering the comments, we continue to believe
that the creation of a limited express permission in the HIPAA Privacy
Rule to disclose information relevant to the Federal mental prohibitor
for NICS purposes is necessary to address barriers to reporting. In
particular, to the extent that some States do not require reporting by
law, and reporting entities in those States may face administrative or
other challenges in creating a hybrid entity, the HIPAA Privacy Rule
may create impediments to reporting that cannot be cured through mere
guidance. Therefore, we believe such an express permission will serve
an important public safety interest by removing a barrier to reporting
that may exist in certain circumstances and thereby potentially
increase reporting by States that historically have reported little or
no Federal mental health prohibitor data to the NICS due to concerns
about violating the Privacy Rule.
Further, we believe that the limitations contained in the narrowly
tailored express permission we adopt appropriately respond to
commenters' important concerns about discouraging individuals who need
mental health treatment from seeking care. First, we limit the
permission to only those covered entities that order the involuntary
commitments or make the other adjudications that cause individuals to
be subject to the Federal mental health prohibitor, or that serve as
repositories of such information for NICS reporting purposes. Thus, the
rule does not affect most treating providers or create a permission for
them to disclose PHI about their own patients for these purposes.
Second, we permit such entities to disclose NICS data only to
designated repositories or the NICS. Third, we limit the information
that may be disclosed to certain demographic or other information that
is necessary for NICS reporting. Finally, we do not expand the
permission to encompass State law prohibitor information. These aspects
of the provision are discussed more fully below. By limiting the
permission in
[[Page 388]]
these ways, we protect the patient-provider relationship. Further, we
believe these limitations carefully balance an individual's privacy
interests with the public safety interest in reporting certain
information to the NICS.
In response to concerns that the rule unfairly singles out
individuals with mental illness, we emphasize, as we did in the
proposed rule, that a mental health diagnosis does not, in itself, make
an individual subject to the Federal mental health prohibitor, which
requires an involuntary commitment or adjudication that the individual
poses a danger to self or others or lacks the mental capacity to
contract or manage his or her own affairs.
In addition, the Department continues to support efforts by the
Administration to dispel negative attitudes and misperceptions relating
to mental illness and to encourage individuals to seek voluntary mental
health treatment. With the implementation of the Affordable Care Act,
millions of Americans who did not previously have coverage will receive
coverage for mental health services.
B. Comments Regarding the Scope of the Permission
Expanding to State Law Prohibitors
Comments: We received several comments in response to our question
about whether the permission should be expanded to include State law
prohibitors. Of these, a minority of commenters supported expanding the
proposed rule to permit disclosures of information about individuals
who are subject to State-only mental health prohibitors (i.e., State
prohibitors that have different criteria than the Federal mental health
prohibitor). Several commenters who advocated for the disclosure of
such information for NICS reporting purposes asserted that State law
prohibitors would be effective only if accurate and adequate
information were submitted to the NICS. One of these commenters argued
that State efforts to report disqualifying records to the NICS should
be encouraged, not curtailed by confusion over the applicability of the
HIPAA Privacy Rules. The commenter also argued that it would create
greater confusion not to include the same express permission with
respect to State mental health prohibitor information as was proposed
for the reporting of information related to the Federal mental health
prohibitor.
Another commenter who supported a permission to disclose
information about individuals who are subject to State-only mental
health prohibitors argued that increasing the disclosures to the NICS
about individuals who are prohibited by State law (but perhaps not
Federal law) from purchasing firearms could address the situation in
which a person who is subject to a prohibitor in the person's State of
residence enters another State temporarily for the sole purpose of
obtaining a firearm and then returns to the State where ownership is
prohibited with a firearm. This commenter voiced the concern that, if
the State of residence does not provide information about individuals
who are subject to State law prohibitors to the Federal background
check system, a FFL in another State would not know that the individual
is subject to a prohibitor.
Several commenters asserted that an express permission to disclose
information about individuals who are subject to State mental health
prohibitors would help to avoid a misinterpretation that HIPAA
prohibits disclosures of PHI relevant to State mental health
prohibitors in circumstances when HIPAA otherwise would not. Another
commenter argued that, as some State law prohibitors were enacted
before HIPAA, State legislators would not have foreseen HIPAA-related
obstacles to disclosure or the resulting need to require reporting to
the NICS by law; as a result, those States may not have laws in place
to require the reporting of State law prohibitors.
One commenter who supported extending the permission argued that
the reporting of State mental health prohibitors would be consistent
with congressional intent, as expressed through statutes aimed at
preventing gun violence. The commenter asserted that the NICS was
established under the Brady Gun Law to serve as a central aggregated
database of information regarding the identities of individuals who are
prohibited from possessing firearms under any Federal, State, or local
law.
In contrast, a number of commenters, including several associations
of mental health professionals, expressed concern that expanding the
reporting permission to apply to State law mental health prohibitors
would involve more treating health care providers in NICS reporting,
and that individuals would not seek treatment for mental health
problems if they felt that simply by seeking treatment they could be
reported to the NICS.
Several commenters, including two mental health professional
associations, expressed concern that State mental health prohibitors
are being expanded in an overly broad manner that will further negative
attitudes and misperceptions about mental illness. The commenters
pointed to an example of a State statute that requires health care
providers to report to the NICS the identities of all individuals with
intellectual disabilities, as well as individuals who voluntarily
commit themselves to a mental institution.
The CCDRTF provided additional examples of State law mental health
prohibitors that are significantly broader than the Federal mental
health prohibitor and expressed concern that many of these State
prohibitors apply to individuals without the benefit of an adjudication
by a court, board, commission or other lawful authority, as provided
for under the Federal prohibitor.\28\ This commenter asserted that the
Federal mental health prohibitor forbids the reporting of information
to the NICS about individuals who are subject to broader State mental
health prohibitors due to a lack of equivalent procedural protections
for such individuals; therefore, this commenter argued, to permit
reporting related to State mental health prohibitors would violate the
Supremacy Clause and raise due process concerns.
---------------------------------------------------------------------------
\28\ This commenter described laws enacted in four States.
According to the commenter, New York law requires all mental health
professionals to report any person undergoing treatment that is
``likely to engage in conduct that would result in serious harm to
self or others'' (citing N.Y. Mental Hygiene. Law Sec. 9.46), while
New York's SAFE Act requires mental health treatment providers to
report covered individuals to a state database without an
adjudicatory process (citing N.Y. Mental Hygiene Law Sec. 9.46). In
California, the commenter stated, prohibitors apply to individuals
undergoing voluntary inpatient treatment (citing 30 Cal. Welf. &
Inst. Code Sec. 8100(a)); and apply to individuals involuntarily
held as inpatients under 72-hour holds (citing Cal. Welf. & Inst.
Code Sec. 8103(f) and Cal. Welf. & Inst. Code Sec. 5150) without
the types of adjudications contemplated under the Federal mental
health prohibitor (citing 18 U.S.C. 922(g); U.S. v. Rehlander, 666
F.3d 45, 50 (1st Cir. 2012). Finally, the commenter noted that
Illinois and Hawaii have prohibitors that apply to all individuals
who have received particular diagnoses (citing 31 430 Ill. Comp.
Stat. 65/8(g) (intellectual disability) and (s) (developmental
disability); Haw. Rev. Stat. Ann. Sec. 134-7(c) (persons with
significant DSM diagnosed disorder).
---------------------------------------------------------------------------
A number of commenters who opposed the reporting of State mental
health prohibitors expressed concern that the broadest State law
prohibitors would become the de facto national standard if the NICS
were to include State law prohibitors. Others raised concerns about the
increased complexity involved in accurately maintaining the NICS
database with the addition of State law prohibitor records, including
challenges associated with avoiding or identifying duplicate reports,
resulting in less reliability, increased inaccuracy, and improper
[[Page 389]]
denial of rights, as well as adding complexity to appeals.
Response: We share the concerns of commenters that, due to the
breadth of some State law prohibitors, the inclusion of State-only
prohibitors in the permission would increase the involvement of
treating providers in NICS reporting, which could negatively affect
patient-provider treatment relationships and discourage some
individuals from seeking care. While we note that the NICS currently
receives some information on State law prohibitors, given these
concerns and the importance of protecting the patient-provider
relationship, we do not think it is appropriate to expand the
permission with respect to HIPAA covered entities. We agree with the
commenters who stated that the health and safety of individuals and the
public is best served if persons with mental illness obtain appropriate
treatment; by limiting the permission to the narrower Federal mental
health prohibitor, and carefully tailoring the permission in the ways
described throughout this preamble, this final rule is designed to
ensure that such persons are not discouraged from seeking care.
With respect to some commenters' concerns about State mental health
prohibitors being ineffective without a HIPAA disclosure permission, we
note that the Privacy Rule does not affect the reporting of State law
prohibitors by non-HIPAA covered entities, which are the entities that
maintain most of the relevant information. Moreover, to the extent that
covered entities maintain relevant State law prohibitor information and
a State wants to ensure that the reporting of this information can
occur, the Privacy Rule provides certain other avenues for disclosure,
as we have described elsewhere. For example, although our balancing of
interests limits this express permission under HIPAA to disclosures
related to the Federal mental health prohibitor, this rule does not
prevent State legislators from differently balancing the privacy,
health, and public safety issues involved with respect to their State
level mental health prohibitors--nor does the Federal mental health
prohibitor itself prohibit reporting to the NICS of State law
prohibitor information, as a commenter asserted. If State legislators
determine that information related to a State-only prohibitor should be
disclosed despite any potential chilling effect on seeking treatment,
they can enact a State law requiring the relevant entities to report
such information. Alternatively, the relevant covered entities can
create a hybrid entity, separating their HIPAA covered health care
functions from their NICS reporting or repository functions, such that
the information maintained by the covered health care component is
subject to the Privacy Rule, while information held by the non-covered
component can be reported without regard to the Privacy Rule.
We disagree with the commenters who argued that excluding State-
only mental health prohibitor information from the permission will
create confusion. We do not think this will occur because this final
rule clearly indicates that it applies where firearm possession is
prohibited under a specific provision in Federal law. We also note that
the rule delineates the types of covered entities that are permitted to
disclose, the information they are permitted to share, the categories
of individuals covered by the permission, and the entities to which
they can make such disclosures. In addition, we intend to work with DOJ
to develop additional guidance on the categories within the Federal
mental health prohibitor. Moreover, we do not believe this final rule
will create a misperception that HIPAA always prohibits the reporting
to the NICS of individuals who are subject to State-only mental health
prohibitors. As explained elsewhere in this preamble, the Privacy Rule
already permits uses and disclosures of PHI that are required by law,
including State law reporting requirements; also, HIPAA covered
entities that perform both health care and non-health care functions
(e.g., NICS reporting) are permitted to create hybrid entities under
HIPAA so that the Privacy Rule applies only to their health care
functions. This final rule does not change those provisions.
Finally, we do not agree that Congress intended for State (or
local) law prohibitor information to be reported to the NICS in all
circumstances, such as where doing so would conflict with
countervailing privacy concerns due to the treatment relationship
between patients and health care providers. Therefore, this final rule
balances a variety of important interests, including protecting the
privacy of individuals' personal health information, ensuring access to
needed mental health care services, and advancing the public safety
interests in ensuring that persons who are prohibited by Federal law
from purchasing or possessing a firearm for mental health reasons do
not gain access to firearms.
Entities Permitted To Report
Comment: Several commenters, including the AMA and the National
Association of Psychiatric Health Systems, expressed support for the
proposal to limit the permission to only those entities in a State that
are directly involved in the relevant adjudications or maintain records
of them for NICS reporting purposes. These commenters expressed
appreciation for the narrow drafting of the NPRM based on the need to
support provider-patient relationships and encourage individuals with
mental illness to seek appropriate care.
However, several advocacy organizations and many individuals argued
that direct treatment providers should not be permitted to report
information about their patients to the NICS under any circumstances
(i.e., even if they are, or are part of, the entity that orders
involuntary commitments or conducts other relevant adjudications, or
serves as a repository of NICS data). Some of these commenters argued
that reports to the NICS database should come only from the judiciary.
Finally, we did not receive responses to the question we posed in
the NPRM about whether additional types of covered entities within a
State (other than those identified in the proposed regulatory text)
might be expected, and thus should be permitted under the Privacy Rule,
to report data to the NICS or to a State repository.
Response: We agree with the commenters who emphasized the need to
protect the provider-patient relationship, and this final rule
addresses such concerns by limiting the permission to those covered
entities that also perform an adjudicatory or data repository function.
Furthermore, as described more fully elsewhere in this preamble, the
permission does not extend to broader State law prohibitors, which may
not require a formal adjudication or involuntary commitment and whose
inclusion likely would involve more treatment providers in NICS
reporting.
In response to comments arguing that only entities in the court
system should be permitted to report to NICS, it is our understanding,
based on public comments and our fact finding, that courts do not
create or maintain records of all of the involuntary commitments or
other adjudications that make individuals subject to the Federal mental
health prohibitor. Therefore, for the NICS database to include reports
of all persons subject to the mental health prohibitor, it is necessary
for certain other entities that create or maintain such information to
be able to report. We believe this permission will help strengthen the
background check system to ensure that individuals who are prohibited
from purchasing or
[[Page 390]]
possessing firearms are prevented from obtaining them. We also
acknowledge the concerns of commenters who argued that providers should
not be permitted to report information about their patients under any
circumstances. As explained in more detail elsewhere in this preamble,
to address these and other concerns, we have carefully tailored this
final rule to limit the involvement health care providers, and to
prevent disclosures of diagnostic or clinical information for NICS
reporting purposes.
Demographic and Certain Other Information Permitted To Be Reported
Comment: Many commenters specifically voiced support for the NPRM's
proposal not to permit the disclosure of diagnostic or clinical
information for NICS reporting purposes. (We also noted in the NPRM
that the NICS does not request or contain such information.) For
example, the American Medical Association stated that it strongly
supported restricting the information disclosed to the limited
demographic and other information needed for reporting, as the NPRM
proposed. To support the point that NICS reporting is sufficiently
limited, another commenter pointed out that the information that is
reported to the NICS generally is provided by the individual to a FFL
on the required application for the firearm.
In contrast, one commenter asserted that, as written, the proposed
permission would grant discretion to state entities to determine the
scope of ``demographic and certain other information'' to be reported
and argued further that DOJ (specifically ATF), not HHS, has authority
to define the ``minimum'' information required by NICS.
In response to our request for comment on whether, and in what
circumstances, entities currently report, or should be permitted to
report, additional data elements needed to confirm an individual's
identity, the Connecticut Department of Mental Health and Addiction
Services (DMHAS) asserted that certain additional data elements are
helpful in confirming whether an individual is appropriately excluded
from gun purchase or possession in cases where multiple individuals
share the same name and date of birth. Several other commenters agreed
that permitting the disclosure of additional data elements for NICS
reporting purposes would allow more accurate verification of an
individual's identity, resulting in fewer erroneous denials, and would
facilitate the correction and updating of NICS entries.
The Connecticut DMHAS and others suggested the inclusion of some or
all of the following specific data elements: Social Security number,
place of birth, state of residence, height, weight, eye color, hair
color, and race. Social Security number and race were cited as the most
reliable indicators of an individual's true identity.
Response: We agree with the commenters who stated that limiting the
permission to exclude diagnostic and clinical information appropriately
balances individuals' privacy interests and public safety priorities.
We also agree that there may be data elements beyond those needed to
create the NICS record (i.e., the individual's name, sex, and date of
birth; as well as codes identifying (1) the Federal mental health
prohibitor, (2) the record documenting the involuntary commitment or
adjudication, and (3) the entity from which the record initiated) that
may be helpful in verifying identity and excluding false matches. Given
that, the final rule provides some flexibility for States or reporting
entities. We do not specify in the regulatory text which data elements
may be disclosed, but clarify in this preamble that what generally
would be considered the information ``needed for purposes of reporting
to the [NICS]'' in Sec. 164.512(k)(7)(iii)(A) would be the data
elements required to create a NICS record, as well as the following
elements to the extent necessary to exclude false matches: Social
Security number, State of residence, height, weight, place of birth,
eye color, hair color, and race (and we note that the Federal Bureau of
Investigations (FBI) and not ATF has the authority to define the
information required by NICS). As indicated above, these are the same
elements that were identified in the NPRM.
C. Comments Regarding the NICS and the Federal Mental Health Prohibitor
Comment: Many commenters raised concerns about infringement of
individuals' Second Amendment right to bear arms without due process. A
number of these commenters specifically expressed concern that an
individual could be reported to the NICS without a formal adjudication
through the court system and argued that due process under the
Constitution would require a hearing in a court of law before an
individual could be made subject to the Federal mental health
prohibitor.
Response: We acknowledge the views of the commenters. However, as
we explained in the NPRM, these concerns relate to the Federal mental
health prohibitor rather than the HIPAA Privacy Rule or this final
rule, and thus are outside the scope of this rule. This final rule
addresses HIPAA-related barriers to entities reporting certain
information to the NICS about individuals who are subject to the
Federal mental health prohibitor. The rule does not expand the
categories of federally prohibited persons or modify the criteria for
determining that a person is subject to the Federal mental health
prohibitor.
Comment: Several disability rights advocates and others asserted
that the rule would not result in a decrease in gun violence because
mental illness alone does not make a person more likely to commit
violence against others. The Consortium for Citizens with Disabilities
Rights Task Force (CCDRTF) cited studies indicating that mental illness
alone is not statistically related to future violence and that even
severe mental illness without drug use or a history of violence is not
linked with future violence.\29\ Several commenters also noted that
persons with mental illness are more likely to be the victims of
violence than its perpetrators. Alternatively, several commenters
argued that, even if there were a link between mental illness and gun
violence, the proposed rule is not needed because mechanisms already
are in place in place to prevent harm from patients who are a threat to
themselves or the public.
---------------------------------------------------------------------------
\29\ CCDRTF cited Eric B. Elbogen & Sally C. Johnson, The
Intricate Link Between Violence and Mental Disorder: Results from
the National Epidemiologic Survey on Alcohol and Related Conditions,
66 Arch. Gen. Psychiatry 152, 157 (Feb. 2009); David J. Vinkers, et
al., Proportion of Crimes Attributable to Mental Disorders in the
Netherlands Population, 11 World Psychiatry 134 (June 2012). CCDRTF
also indicated that other studies showed a modest relationship
between serious mental illness and violence, but that other factors
(e.g., substance abuse, age, gender and lower economic status)
contribute more to increasing the likelihood of committing violence
than mental illness alone. They cited R. Van Dorn, et al., Mental
Disorder and Violence: Is There a Relationship Beyond Substance
Use?, 47 Social Psychiatry and Psychiatric Epidemiology 487, 499
(2012).
---------------------------------------------------------------------------
Response: We acknowledge the views of the commenters. However,
these commenters address the applicability of the Federal mental health
prohibitor itself. This final rule does not expand the existing
categories of persons prohibited from owning a firearm or modify other
Federal or State laws pertaining to firearms purchases. Therefore,
these comments are beyond the scope of this rule.
Comment: Several commenters raised questions about individuals'
ability to correct erroneous NICS reports or to
[[Page 391]]
have their rights restored when they no longer pose a danger to
themselves or others. A number of commenters recommended assuring that
the appeals process is free of delay, inexpensive, and easy for
individuals to initiate.
Other commenters asserted that the expense to remove oneself from
the NICS database is prohibitive for some individuals. As a result, the
commenters said, individuals effectively become subject to a lifelong
restriction on their Second Amendment right to bear arms, even after
they recover from the condition that led to their adjudication and are
eligible to apply for relief from disabilities under the Federal mental
health prohibitor. Similarly, one commenter argued that, once an
individual is reported to the NICS, the ``relief from disabilities''
process \30\ is inadequate for remediation due to a lack of Federal
funding to support State programs, and wide variability in State
programs to provide relief as a result. Another commenter recommended
allocating additional funding to support State ``relief from
disabilities'' programs.
---------------------------------------------------------------------------
\30\ See footnote 13 above.
---------------------------------------------------------------------------
Response: These comments are outside the scope of the rule.
However, we acknowledge the commenters' concerns with respect to
opportunities for remediation and note that individuals who believe
they are wrongly denied the purchase of a firearm can visit https://forms.fbi.gov/nice-appeals-request-form to find out more information
and appeal their denial. In addition, the NICS Improvement Amendments
Act of 2007 authorized grants for States that implement programs for
``relief from disabilities'' in accordance with the Act.\31\ These
programs are required to establish processes by which an individual who
is subject to the Federal mental health prohibitor may apply for relief
to the State where the relevant commitment or adjudication occurred.
While States' processes for granting relief vary, the Act requires that
relief be granted if it can be established that the circumstances
regarding the disability and the applicant's record and reputation are
such that the applicant will not be likely to act in a manner dangerous
to public safety, and the granting of relief would not be contrary to
the public interest.\32\
---------------------------------------------------------------------------
\31\ The DOJ Bureau of Justice Statistics provides state data on
NICS Act Record Improvement Program (NARIP) Awards (available at
https://www.bjs.gov/index.cfm?ty=tp&tid=491#promising).
\32\ See Public Law 110-180, Section 105.
---------------------------------------------------------------------------
Comment: A number of commenters expressed concern that a finding of
mental incompetence by the Veterans Administration (VA), which could
make an individual subject to the Federal mental health prohibitor and
cause the individual to be reported to the NICS, may be based solely on
a determination that the veteran is unable to handle financial affairs,
without regard to dangerousness. The commenters argued that these
veterans do not receive due process before being made subject to the
Federal mental health prohibitor and believed that the proposed rule
would exacerbate this problem.
Response: We note that, as a federal agency, the VA is required by
law to report prohibited persons to the Attorney General, who oversees
the NICS.\33\ This final rule does not affect that requirement or
change the procedures relating to adjudications that make individuals
subject to the Federal mental health prohibitor.\34\
---------------------------------------------------------------------------
\33\ See NICS Improvement Amendments Act of 2007 Sec. 101, 18
U.S.C. 922 note (2002).
\34\ We refer commenters to the VA regulations for information
about the due process afforded to veterans as part of VA competency
determinations. See 38 CFR 3.353 and 38 CFR 3.103.
---------------------------------------------------------------------------
D. Other Comments
Comment: A few commenters expressed concern that covered entities
would misinterpret the proposed permission as a requirement to report
information about their patients to the NICS. Another commenter
expressed concern that the standards for reporting NICS data will be
adopted by courts as a new standard of care for health care providers,
exposing covered entities that do not report to increased liability.
The commenter requested that the Department clarify that the HIPAA
permission is permissive, not mandatory.
Response: This final rule establishes permission for certain HIPAA
covered entities--those with lawful authority to make the adjudications
or commitment decisions that make individuals subject to the Federal
mental health prohibitor, or that serve as repositories of information
for NICS reporting purposes--are permitted to disclose the information
needed for these purposes. The rule does not create a requirement to
disclose. In addition, as explained at length in the NPRM and above,
the rule does not apply to most treating providers, but only to those
covered entities that are responsible for the involuntary commitments
or other adjudications that make individuals subject to the Federal
mental health prohibitor, or that serve as repositories of such data.
However, we note that covered entities have a responsibility to comply
with all applicable laws, and this final rule does not preempt State or
other laws that may require reporting to the NICS.
Comment: One commenter recommended that the Department evaluate
whether the rule would have the unintended consequence of permitting
the reporting of individuals based on mere medical findings.
Response: As we explain above, the rule does not create a broad
permission for treating providers to report information about their
patients to the NICS. Rather, the rule is narrowly tailored to permit
limited disclosures of information about individuals who are subject to
the Federal mental health prohibitor, which applies only where an
individual has been involuntarily committed or otherwise has received a
relevant adjudication from a court, board, commission, or other lawful
authority.
Comment: One commenter recommended training for the workforce
members of reporting entities to ensure that they understand the
applicable reporting protocols sufficiently to avoid making erroneous
reports.
Response: We agree that training is generally beneficial to assure
compliance with applicable standards. Further, to the extent that
reporting entities also are HIPAA covered entities, the Privacy Rule
requires those entities to train workforce members on the policies and
procedures with respect to the privacy and security of individuals'
health information. Where applicable, such training would include
ensuring that workforce members have copies of the entity's policies
and procedures implementing this final rule's limited permission for
uses or disclosures of PHI for NICS reporting purposes.
Comment: One commenter recommended establishing a mechanism to
inform mental health patients and their caregivers about the patients'
status in the NICS.
Response: We decline to provide for such a mechanism in this final
rule because it is outside the scope of the rule. Nothing in this rule,
however, precludes covered entities from informing individuals that
information about them has been provided to the NICS.
Comment: Several commenters expressed concern that, by allowing
multiple entities within a State to report to the NICS, the proposed
rule would create complexity, inaccuracy, and delay in processing
appeals, particularly if the FBI refers the individual back to the
reporting entity for resolution.
Response: To the extent that the involvement of multiple entities
in NICS reporting may affect the appeals process in a state, this issue
exists apart
[[Page 392]]
from HIPAA. Each State determines the entity or entities responsible
for reporting NICS data, depending on where the records documenting a
person's status as subject to one or more of the Federal prohibitors
are created or maintained. As a result, a variety of entities,
including judicial, law enforcement, public health, and other entities
in a State, already may be involved in NICS reporting and appeals.
Comment: A few commenters expressed concern that, as a result of
the proposed rule, some families may choose not to seek involuntary
commitment proceedings for a family member who needs treatment, but
whose livelihood depends on the ability to possess a firearm (e.g.,
first responders and members of the military), because the commitment
would result in a report to the NICS and the loss of the patient's
livelihood.
Response: We note that the Federal mental health prohibitor makes
the purchase or possession of firearms by prohibited individuals
unlawful regardless of whether an individual is reported to the NICS,
and this final rule does not change who is subject to the Federal
mental health prohibitor. This final rule also does not affect law
enforcement and military entities' authorities with respect to making
their workforce decisions.
Comment: One commenter asked whether covered entities are obligated
to update information they have submitted to the NICS when an
individual's circumstances change.
Response: Section 102(c)(1)(B) of the NIAA requires States to
update, correct, modify, or remove a record from the NICS if they
determine that the person is not prohibited or has received ``relief
from disabilities'' under the mental health prohibitor.
Comment: A number of commenters argued that the proposed regulation
would contravene congressional intent, arguing that Congress did not
intend to change HIPAA protections for NICS purposes. The commenters
stated that legislation on this topic had been considered and rejected
and specifically cited S. 649 (the ``Fix Gun Checks Act''), which was
considered by the Senate on April 18, 2013, but did not receive a vote.
Similarly, some commenters asserted that Congress could have
included any desired changes to HIPAA when it passed the NICS
Improvements Amendments Act, but did not do so. Therefore, the
commenters argued, Congress did not intend to modify HIPAA for NICS
reporting purposes.
Response: That Congress did not enact S. 649 does not provide
relevant evidence of congressional intent with respect to the scope of
the HIPAA Privacy Rule. The absence of a provision in the NIAA to
modify HIPAA does not imply that Congress intended to prevent any
revisions of the HIPAA Privacy Rule with respect to the NICS. The HIPAA
statute confers broad authority on the Department to specify the
permitted uses and disclosures of PHI by HIPAA covered entities, and
NIAA does not affect this statutory authority.
Comment: Several disability rights organizations asserted that the
proposed rule did not provide sufficient evidence of HIPAA barriers to
reporting in any State to fulfill a requirement of the Administrative
Procedure Act (APA) that there be a rational connection between the
facts found by a Federal agency through the rulemaking process and the
regulatory choice made.\35\
---------------------------------------------------------------------------
\35\ 5 U.S.C. Subchapter II.
---------------------------------------------------------------------------
Response: We disagree with the commenters. As stated above, we
understand from other comments that at least seven States currently
rely on HIPAA covered entities (such as mental health facilities) to
report Federal mental health prohibitor data to the NICS. These seven
States have laws regarding such reporting, but other States may not. To
the extent that any other State does not require NICS-related
disclosures by law and the State has not enacted legislation addressing
the problem, the Privacy Rule, prior to the effective date of this
final rule, would have prevented such disclosures by HIPAA covered
entities that do not have hybrid entity status.\36\ Therefore, there
are sufficient data demonstrating that HIPAA's disclosure restrictions
can be a barrier to NICS reporting, and thus to the development of an
accurate and comprehensive NICS database. The data support finalizing
this modification to the Privacy Rule, which removes barriers while
limiting the circumstances under which covered entities may disclose
PHI to the NICS and limiting the types of PHI that may be disclosed.
---------------------------------------------------------------------------
\36\ We note that at least three states have laws permitting,
but not requiring the disclosure of mental health records to the
NICS: Missouri, New Jersey and West Virginia. See Mo. Rev. Stat.
630.140 (2013); N.J. Stat. Ann. 30:4-24.3 (2013); W.Va. Code 61-7A-3
(2013).
---------------------------------------------------------------------------
We know of one State in particular in which the Privacy Rule's
disclosure restrictions posed challenges for NICS reporting. The State
of New York had a statute requiring mental health facilities in the
State to report NICS data to the State mental health agency, the
State's designated repository of NICS data.\37\ As a result, the
Privacy Rule permitted such disclosures to the repository as required-
by-law disclosures. However, the statute did not expressly require the
mental health agency, which was a covered entity under HIPAA that did
not have hybrid entity status, to report the data it collected to the
NICS; the Privacy Rule thus did not permit the agency to disclose this
data. Ultimately, the legislature needed to revise the statute to
expressly require the agency to report the data to the NICS.\38\
---------------------------------------------------------------------------
\37\ 2008 N.Y. Laws 491, codified at N.Y. Mental Hyg. Sec. Sec.
7.09(j); 13.09(g), 31.11(5), 33.13(b), (c) (2011); N.Y. Jud. Ct.
Acts Sec. 212(q) (2011).
\38\ NY Secure Ammunition and Firearms Enforcement (SAFE) Act of
2013.
---------------------------------------------------------------------------
In addition to removing barriers, an additional benefit of the rule
as described more fully below is that it provides clarity about the
applicability of the Privacy Rule and its relationship to State law in
this area, as well as provides an avenue for NICS reporting that may
obviate the need to enact legislation at the State level.
Comment: One commenter requested that the Department clarify how
HIPAA's preemption provisions would apply to State laws requiring or
prohibiting covered entities' disclosures of NICS data.
Response: We clarify that this final rule does not change HIPAA's
existing preemption provisions, which provide that the HIPAA rules
preempt contrary State laws (with certain exceptions, such as where the
contrary provision of State law is more stringent than the HIPAA
provision).\39\ Accordingly, because the Privacy Rule, as modified by
this final rule, only permits (but does not require) the disclosure for
NICS reporting purposes, State laws that prohibit such disclosures are
not contrary to the Privacy Rule, and covered entities in States with
such laws remain subject to any applicable prohibitions against the
disclosures under State law. That is, the covered entity could comply
with both HIPAA and such State law by not disclosing PHI to the NICS.
---------------------------------------------------------------------------
\39\ See 45 CFR 160.203.
---------------------------------------------------------------------------
Moreover, HIPAA contains an express permission for disclosures that
are required by other law, such as State law. Accordingly, State laws
that require disclosures, for any purposes, remain in effect, as such
laws are not contrary to the Privacy Rule.
Comment: One commenter expressed concern that the rule would create
an opportunity for the abuse of private information, for example, by
allowing the government to disarm political dissidents who seek mental
health care,
[[Page 393]]
or making it possible for medical personnel to abuse their authority
and remove an individual's rights for illegitimate reasons.
Response: Concerns about governmental or private actors taking
advantage of this permission to target vulnerable persons are addressed
by the procedural framework built into the statute that established the
Federal mental health prohibitor and its implementing regulations,
which this final rule does not change. As we previously have noted, the
Federal mental health prohibitor, which makes an individual reportable
to the NICS, applies only to the extent that the individual is
involuntarily committed or determined by a court, board, commission, or
other lawful authority to be a danger to self or others, or is unable
to manage his or her own affairs due to a mental illness or condition.
\40\ These involuntary commitments and other adjudications are not made
independently by individual health care providers without any form of
official legal review.
---------------------------------------------------------------------------
\40\ 18 U.S.C. 922(g)(4); 27 CFR 478.11.
---------------------------------------------------------------------------
Comments: Some commenters expressed concern that, by relaxing
HIPAA's privacy requirements, the proposed rule could result in
increased disclosures of private health information to the government.
Several commenters argued that the Federal government has a poor record
on protecting individuals' privacy and should not be entrusted with
health information. In contrast, another commenter noted that Federal
law, including the Privacy Act, prohibits access to the information in
the NICS database outside of the limited purposes authorized by law,
and information about specific firearms transfers is destroyed the day
after the transaction.
Response: We agree that it is important to protect the privacy and
security of the information that is reported to the NICS and we note
that the NICS is subject to specific privacy and security
protections.\41\ In addition, we again emphasize that only very limited
information may be disclosed under this rule, and disclosures of
diagnostic or clinical information are expressly prohibited.
---------------------------------------------------------------------------
\41\ See 63 FR 58303 (October 30, 1998), codified at 28 CFR part
25.
---------------------------------------------------------------------------
Comment: Finally, one commenter requested clarification on whether,
in States where a covered entity is also a lawful authority that orders
involuntary commitments or conducts other adjudications that make
individuals subject to the Federal mental health prohibitor, there is
intended to be a separation between the covered entity and lawful
authority functions of the entity.
Response: We note that, under the Privacy Rule, both before and
after the modification made in this final rule, a covered entity could
provide for such separation by operating as a hybrid entity, and
disclose information through its non-HIPAA covered NICS reporting unit.
However, it is our understanding that some covered entities may be
unable to achieve hybrid entity status for administrative or other
reasons. This is another reason for including the express permission
described in the final rule.
VI. Regulatory Analyses
A. Introduction
We have prepared a regulatory impact statement in compliance with
Executive Order 12866 (September 1993, Regulatory Planning and Review),
Executive Order 13563 (January 2011, Improving Regulation and
Regulatory Review), the Regulatory Flexibility Act (RFA) (September 19,
1980, Pub. L. 96-354), the Unfunded Mandates Reform Act of 1995 (UMRA)
(March 22, 1995, Pub. L. 104-4), and Executive Order 13132 on
Federalism.
1. Executive Order 12866 and Executive Order 13563
Executive Orders 12866 and 13563 direct agencies to assess all
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). Executive
Order 13563 emphasizes the importance of quantifying both costs and
benefits, of reducing costs, of harmonizing rules, and of promoting
flexibility. This rule has been designated a ``significant regulatory
action'' although not economically significant, under section 3(f) of
Executive Order 12866. Accordingly, this rule has been reviewed by the
Office of Management and Budget.
A regulatory impact analysis must be prepared for all major rules
that have economically significant effects ($100 million or more in any
one year) or adversely affect in a material way the economy, a sector
of the economy, productivity, competition, jobs, the environment,
public health or safety, or State, local, or tribal government or
communities (58 FR 51741). Because the final rule does not contain any
new requirements or prohibitions for covered entities, we estimate that
the rule will be cost neutral. We did not receive public comments on
this assumption or information indicating that covered entities will
incur any costs as a result of the rule.
Although we expect the economic impact of the rule, including non-
quantifiable costs and savings discussed in the regulatory analysis
below, to be less than $100 million annually, we nevertheless conducted
an analysis of the costs of the final rule.
2. Entities Subject to the Rule
This final rule applies only to covered entities that function as
repositories of information relevant to the Federal mental health
prohibitor on behalf of a State or that are responsible for ordering
the involuntary commitments or other adjudications that make an
individual subject to the Federal mental health prohibitor. We do not
have sufficient data to determine the number of affected entities, but,
based on the information available to us, we believe there would be
very few. Our understanding is that, for the most part, formal
adjudications and repository functions of this nature are conducted by
entities, such as court systems or law enforcement agencies, that are
not covered by HIPAA. In addition, even covered entities in some states
will not be affected because they currently do not face HIPAA barriers
to reporting either because state law requires reporting or they have
created hybrid entities, as described above in the preamble. We did not
receive public comments on the number of covered entities that will be
affected by this rule.
B. Why is this rule needed?
This final rule is needed to ensure that, where HIPAA covered
entities make adjudications causing individuals to become subject to
the Federal mental health prohibitor, or serve as repositories of
records of such adjudications on behalf of States, those covered
entities can report the identities of those individuals to the NICS.
This rule change can help further the important public safety goal of
strengthening the background check system to ensure that individuals
who are prohibited from purchasing or possessing firearms are not able
to obtain them. Specific permission under the Privacy Rule for these
disclosures is necessary to the extent that some States have not
enacted laws requiring reporting to the NICS, but a covered entity in
the State is nevertheless responsible for such reporting and does not
become a hybrid entity. Importantly, the final rule permits only a
small subset of HIPAA covered entities (i.e.,
[[Page 394]]
those that perform the relevant mental health adjudications or
repository functions) to use or disclose only limited, non-clinical
information, for NICS purposes. This narrowly tailored permission
permits these important uses or disclosures for public safety to occur
while maintaining a separation between reporting functions and the
mental health treatment a patient might be receiving.
C. Qualitative Analysis of Unquantified Costs
The rule is cost neutral with respect to HIPAA covered entities.
The rule does not require entities that already have a NICS reporting
process in place to change their current system and does not create new
reporting or recordkeeping requirements for any covered entity. The
small number of covered entities that are newly permitted to report to
the NICS or a State repository under the rule can begin to report and
may need to develop policies and procedures to do so. As the Privacy
Rule only allows the use or disclosure of information, and does not
require it, any resulting burden of reporting and associated procedures
are attributable to the choice made by an entity to report information,
the Federal statutory mental health prohibitor, and the NICS system
itself. See 28 CFR part 25, subpart A. We acknowledge that those
entities that choose to begin reporting may wish to address this change
in their HIPAA policies and procedures, as well as explain their
procedures to office staff. However, the rule does not require any
changes to existing HIPAA policies and procedures. In addition, with
respect to training, the rule does not require workforce training
beyond what is already required under the HIPAA Privacy and Security
Rules. We expect that entities that choose to report under the rule
would also take steps to ensure that their office staff have copies of
the new policies and procedures, which would not involve any
significant additional costs. We did not receive public comments
contradicting these assumptions or estimating the number of entities
that might begin to report to the NICS for the first time, if any.
To the extent that the rule permits some covered entities to report
to the NICS for the first time, there may be an increase in the number
of individuals whose identities are newly included in the NICS and who
are denied a firearm transfer as a result. Therefore, there may be a
concomitant increase in applications for ``relief from disabilities''
in states that provide such a relief program. However, any burden to
individuals completing and submitting the relief application form is
attributable to the Federal mental health prohibitor and the procedures
established by the State where the commitment or adjudication occurred.
The procedures for applying for relief in States that have established
mental health prohibitor ``relief from disabilities'' programs pursuant
to the NICS Improvement Amendments Act of 2007 vary.
We received a number of comments on the NPRM asserting that
creating an express permission in the Privacy Rule for NICS reporting
would discourage individuals from seeking needed mental health care. We
appreciate these concerns and agree with commenters who asserted that
individuals' health and the public's safety are best served by
encouraging appropriate treatment. We also recognize that discouraging
treatment could increase the burden of untreated mental conditions to
individuals, in the form of increased suffering and loss of
productivity; to the health care system, when individuals with
untreated mental illness need emergency hospitalization, for example;
and to the public's safety. However, many of these commenters expressed
the mistaken belief that the permission would allow or require most
mental health care providers to report their patients to the NICS.
As explained above, we have carefully and narrowly tailored the
final rule to apply only to a small number of covered entities that may
be responsible for the adjudications that make an individual subject to
the Federal mental health prohibitor, or that serve as repositories of
data about such adjudications. The rule generally maintains a
separation between treatment functions and NICS reporting functions. In
addition, the rule does not permit the use or disclosure of any
diagnostic or clinical information, or any other information about an
individual that is not needed for NICS reporting purposes. Because of
these strict limitations on the permitted uses and disclosures, we
believe that individuals will not be dissuaded from seeking needed
mental health care services as a result of the rule.
Finally, we recognize the intangible burden to individuals of the
negative attitudes and misperceptions associated with mental health
conditions. We note that the Federal mental health prohibitor does not
apply to all individuals with mental health conditions, but instead to
a subset of individuals who have been involuntarily committed or
determined by a lawful authority to be a danger to themselves or
others, or unable to manage their own affairs, as a result of marked
subnormal intelligence, or mental illness, incompetency, condition, or
disease. This rule permits a limited number of HIPAA covered entities
to report to the NICS the identities of individuals in a particular
subcategory of persons who are currently prohibited by Federal law from
possessing firearms. This permission facilitates the enforcement of
prohibitions that were established by the Gun Control Act. Therefore,
we do not expect that this rule will exacerbate negative attitudes or
misperceptions associated with mental health conditions.
D. Qualitative Analysis of Unquantified Benefits
While we believe that there may be benefits to public safety as a
result of the rule, we are not able to monetize the value of such
benefits.
For example, by removing a barrier to reporting, the rule may
result in increased reporting to the NICS of individuals who may pose a
risk of gun violence related to a serious mental health condition. To
the extent that this rule permits covered entities to report those
individuals' identities for NICS purposes, the rule provides a public
safety benefit. One comment submitted in response to the NPRM noted
that increased reporting could contribute to lowering the substantial
financial costs of gun violence itself, which was estimated at $174
billion in medical and lost productivity expenses in 2010.\42\ However,
we do not have information about whether, or how many, covered entities
would begin to report or increase reporting to the NICS as a result of
the rule, nor do we have a basis for estimating the impact, if any, on
the financial costs associated with gun violence.
---------------------------------------------------------------------------
\42\ This comment cited Miller TR. The Cost of Firearm Violence.
Children's Safety Network Economics and Data Analysis Resource
Center, at Pacific Institute for Research and Evaluation, December
2012.
---------------------------------------------------------------------------
An additional benefit of the rule is that it provides clarity about
the applicability of the Privacy Rule and its relationship to State
law. Specifically, the rule alleviates the concerns of State lawmakers
who, according to several commenters on the ANPRM, may be reluctant to
pursue State legislation requiring entities to report Federal mental
health prohibitor information for NICS purposes because of a
misconception that the HIPAA Privacy Rule would preempt such
requirements. As explained more fully above, the Privacy Rule permits
uses and disclosures that are required by law, and
[[Page 395]]
thus would not preempt a State law requiring disclosures to NICS.
However, to the extent that State lawmakers harbor this misconception,
this preamble clarifies HIPAA's preemption provisions and the final
rule provides an avenue for NICS reporting that may obviate the need to
enact legislation at the State level.
E. Additional Regulatory Analyses
1. Regulatory Flexibility Act
The RFA requires agencies to analyze and consider options for
reducing regulatory burden if a rule will impose a significant burden
on a substantial number of small entities. The Act requires the head of
the agency either to certify that the rule will not impose such a
burden or to perform a regulatory flexibility analysis and consider
alternatives to lessen the burden. For the reasons explained more fully
above in the summary of costs and benefits, it is not expected that the
rule will result in compliance costs for covered entities of any size
because the rule does not impose new requirements. Therefore, the
Secretary certifies that the rule will not have a significant impact on
a substantial number of small entities.
2. Unfunded Mandates Reform Act
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA)
requires that agencies assess anticipated costs and benefits before
issuing any rule whose mandates would require spending in any one year
$100 million in 1995 dollars, updated annually for inflation. In 2013,
that threshold is approximately $141 million dollars. UMRA does not
address the total cost of a rule. Rather, it focuses on certain
categories of cost, mainly those ``Federal mandate'' costs resulting
from: (1) Imposing enforceable duties on State, local, or Tribal
governments, or on the private sector; or (2) increasing the stringency
of conditions in, or decreasing the funding of, State, local, or Tribal
governments under entitlement programs. As this rule does not impose
enforceable duties or affect entitlement programs, UMRA does not
require us to prepare an analysis of the costs and benefits of the
rule. Nonetheless, we have done so in accordance with Executive Orders
12866 and 13563, and present this analysis in sections C and D above.
3. Federalism
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a rule that imposes substantial
direct requirement costs on State and local governments, preempts State
law, or otherwise has Federalism implications.
The Federalism implications of the HIPAA Privacy and Security Rules
were assessed as required by Executive Order 13132 and published as
part of the preambles to the final rules on December 28, 2000 (65 FR
82462, 82797) and February 20, 2003 (68 FR 8334, 8373), respectively.
This final rule does not impose requirements, or any associated costs,
on State and local governments. Regarding preemption, the preamble to
the final Privacy Rule explained that the HIPAA statute dictates the
relationship between State law and Privacy Rule requirements.
Therefore, the Privacy Rule's existing preemption provisions do not
raise Federalism issues, and these provisions are not affected by this
rule.
One commenter argued that a permission for entities other than
States to report to the NICS would bypass the decisions of the States
regarding the submission of reports and, therefore, raises federalism
implications. In response, we again emphasize that this rule does not
require covered entities to make disclosures that are prohibited by
State law, nor does it prevent disclosures required by State law.
Further, States retain discretion to determine which entities within
the State are authorized to report information to the NICS. For these
reasons, the rule does not have Federalism implications.
F. Accounting Statement
Whenever a rule is considered a significant rule under Executive
Order 12866, we are required to develop an accounting statement
indicating the costs associated with the rule. As explained above, we
expect that the rule is cost neutral. We did not receive public
comments on any unanticipated costs associated with the rule, including
costs to covered entities that choose to amend written HIPAA policies
and procedures or to provide additional training to staff.
VII. Collection of Information Requirements
This final rule does not contain requests or requirements to report
information to the government, nor does it impose new requirements for
recordkeeping or disclosures to third-parties or the public. Therefore,
the requirements of the Paperwork Reduction Act with respect to
information collections do not apply.
List of Subjects in 45 CFR Part 164
Administrative practice and procedure, Computer technology,
Electronic information system, Electronic transactions, Employer
benefit plan, Health, Health care, Health facilities, Health insurance,
Health records, Hospitals, Medicaid, Medical research, Medicare,
Privacy, Reporting and recordkeeping requirements, and Security.
For the reasons set forth in the preamble, the Department of Health
and Human Services amends 45 CFR Subtitle A, Subchapter C, part 164, as
set forth below:
PART 164--SECURITY AND PRIVACY
0
1. The authority citation for part 164 continues to read as follows:
Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264,
Public Law 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note));
and secs. 13400-13424, Public Law 111-5, 123 Stat. 258-279.
0
2. Amend Sec. 164.512 by adding paragraph (k)(7) to read as follows:
Sec. 164.512 Uses and disclosures for which an authorization or
opportunity to agree or object is not required.
* * * * *
(k) * * *
(7) National Instant Criminal Background Check System. A covered
entity may use or disclose protected health information for purposes of
reporting to the National Instant Criminal Background Check System the
identity of an individual who is prohibited from possessing a firearm
under 18 U.S.C. 922(g)(4), provided the covered entity:
(i) Is a State agency or other entity that is, or contains an
entity that is:
(A) An entity designated by the State to report, or which collects
information for purposes of reporting, on behalf of the State, to the
National Instant Criminal Background Check System; or
(B) A court, board, commission, or other lawful authority that
makes the commitment or adjudication that causes an individual to
become subject to 18 U.S.C. 922(g)(4); and
(ii) Discloses the information only to:
(A) The National Instant Criminal Background Check System; or
(B) An entity designated by the State to report, or which collects
information for purposes of reporting, on behalf of the State, to the
National Instant Criminal Background Check System; and
(iii)(A) Discloses only the limited demographic and certain other
information needed for purposes of reporting to the National Instant
Criminal Background Check System; and
[[Page 396]]
(B) Does not disclose diagnostic or clinical information for such
purposes.
* * * * *
Dated: December 30, 2015.
Sylvia M. Burwell,
Secretary.
[FR Doc. 2015-33181 Filed 1-4-16; 4:15 pm]
BILLING CODE 4153-01-P
