New HIPAA reporting rules take a shot at gun violence

Changes to the disclosure rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) Privacy Rule will allow HIPAA covered entities to disclose the identities of individuals subject to a federal “mental health prohibitor” to the National Instant Criminal Background Check System (NICS). HHS issued an advance release of the Final rule, which will modify HIPAA policy in order to improve background check identification of individuals who are disqualified from shipping, transporting, possessing, or receiving a firearm due to a mental health prohibitor. The reforms are aimed at reducing the incidence of gun violence across the nation.


The NICS is a national system operated by the Federal Bureau of Investigation (FBI) for the purposes of conducting background checks on individuals who may be disqualified from possessing or receiving firearms. Among the list of disqualified persons are individuals who have been: (1) involuntarily committed to a mental intuition; (2) found incompetent to stand trial or not guilty by reason of insanity; (3) or have otherwise been determined by “a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs.”

Covered entities

The Final rule only applies to covered entities that: (1) make the specific adjudications or commitment decisions which render individuals subject to a mental health prohibitor; or (2) or serve as repositories of information for NICS reporting purposes. The authorized disclosures are of a limited scope, pertaining only to demographic information and information necessary for NICS purposes. The Final rule contains an express prohibition on the disclosure of diagnostic or clinical information from patient health records. The NICS only maintains records of the fact that an individual is subject to a mental health prohibitor. Underlying diagnoses, treatment records, and other identifiable health information are not provided to or maintained by NICS.