HIPAA Rule Change Part of Move to Fight Gun Violence

By Joseph Conn for Modern Healthcare

January 6, 2016

Only a few healthcare organizations report to the federal database that conducts background searches on people who want to buy guns, but those groups will get a little more latitude through a final HHS rule that’s part of a White House package announced this week aimed at combating gun violence.

A change to the Health Insurance Portability and Accountability Act clarifies who can share data with the FBI’s National Instant Criminal Background Check System (NICS). HHS says the rule change will facilitate the flow of information from providers to NICS.

The database was created to prevent guns from being sold to prohibited individuals, including felons, but also persons found to be “mentally defective” or who have been involuntarily committed to a mental institution.

The U.S. Justice Department credits NICS with preventing more than 2 million guns from getting into the wrong hands since it was created in 1998.

Most of the records in the NICS database come out of the state civil court systems and are not protected by the HIPAA privacy rule, HHS rule writers said. The rule amendment acknowledges that there are agencies within some states that bill or pay for healthcare and that they can now provide records to NICS. The rule doesn’t state how many entities it will affect. Experts weren’t sure either.

Not all states have laws requiring NICS reporting. If a state has no mandate, or a law that merely authorizes but doesn’t require NICS reporting, the HIPAA provisions can be confusing, HHS rule writers acknowledge.

Under the old privacy rule, reporting to NICS was not allowed under the HIPAA exemption when law enforcement agencies inquired about a person. Disclosures were also not permitted even if the person posed a serious threat to health or safety, according to HHS.

To get around this rule, some state agencies would become a “hybrid entity” by putting a firewall between its healthcare information and other parts of the agency. The non-healthcare portion of the state agency could report to NICS without running afoul of HIPAA.

But even with that workaround, many states, concerned about violating HIPAA law, which carries penalties of up to $50,000 per violation and prison sentences of up to 10 years in cases where the information was used for financial gain, were not reporting to NICS.

According to a 2012 General Accountability Office report, 17 states had submitted fewer than 10 records of people prohibited for mental health reasons from legally buying guns.

Some providers and patient advocacy groups worry sharing information is a potential breach of trust.

Karla Lopez, a staff attorney with the not-for-profit New York-based Legal Action Center, said she is still reviewing the final rule. But when HHS first proposed this change in 2013, the center urged the federal government to not amend HIPAA to allow HIPAA covered entities to report to NICS, preferring that responsibility remain within the judicial system, in part to better protect the patient-provider relationship.

“Maintaining the strongest assurances of confidentiality is essential to attracting and retaining” patients, a letter from the Legal Action Center to HHS said.

The 56-page amendment to the privacy rule (PDF) is a few years in the making. Work on it began after the 2012 deaths of 26 people, most of them children, at a school in Newton, Conn. The gunman had a history of mental health problems.

President Barack Obama this week wiped away tears as he presented his reasons for a number of executive orders, including a request that Congress approve $500 million of additional funding to allow for greater access to mental health treatment.

In an apparent about face, the 36,000-member American Psychiatric Association welcomed Obama’s announcement and promised to work with the administration to encourage Congress to fund the proposal.

“We support the president’s efforts to expand background checks (and) propose policies that respect physician-patient confidentiality,” said APA President Renee Binder.

In a May 2013 comment letter to HHS, however, APA Medical Director and CEO Dr. James Scully Jr. wrote that “the courts are in the best position” to share patient information.

Scully further expressed the group’s “strong reservations” about even those states whose laws direct certain HIPAA covered entities to report patient information to the NICS.

That APA letter said, “Requiring direct reporting by clinicians or facilities is likely to disrupt the clinician-patient relationship and interfere with effective treatment.”

The American College of Physicians agrees that improvements should be made in the law but worries about including mental illness in a category of dangerous individuals.

The changes to the HIPAA rule are unlikely to address another concern of some stakeholders: interoperability. The complex law, some say, has prevented the steady flow of information between providers and interested and authorized agencies.

But the HHS rule change announced this week will not require a change to most providers’ electronic health-record systems or health information exchange networks, said Jeff Chang, CEO of PCE Systems, a Farmington Hills, Mich., developer of EHRs for behavioral health organizations.

“My inclination is the infrastructure is probably already there (for reporting), and it’s not a healthcare infrastructure,” Chang said. He pointed to the Texas court administrator’s office (PDF), which, since 2009, has mandated reporting by all court clerks to NCIS. The court system has its own secure website (PDF) for clerks to complete their reports.

Information that could be disclosed under the new rule includes the patient’s name, sex, date of birth, the record documenting the individual’s involuntary commitment or adjudication for mental health issues and Social Security number. Several law enforcement agencies, both federal, state and local, can access the NICS database for information in connection with various licenses for firearms or explosives.