[Federal Register Volume 79, Number 4 (Tuesday, January 7, 2014)]
[Proposed Rules]
[Pages 784-796]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2014-00055]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 164


Health Insurance Portability and Accountability Act (HIPAA) 
Privacy Rule and the National Instant Criminal Background Check System 
(NICS)

AGENCY: Office for Civil Rights, Department of Health and Human 
Services.

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS or ``the 
Department'') is issuing this notice of proposed rulemaking to modify 
the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 
Privacy Rule to expressly permit certain HIPAA covered entities to 
disclose to the National Instant Criminal Background Check System 
(NICS) the identities of individuals who are subject to a Federal 
``mental health prohibitor'' that disqualifies them from shipping, 
transporting, possessing, or receiving a firearm. The NICS is a 
national system maintained by the Federal Bureau of Investigation (FBI) 
to conduct background checks on persons who may be disqualified from 
receiving firearms based on federally prohibited categories or State 
law. Among the persons subject to the Federal mental health prohibitor 
are individuals who have been involuntarily committed to a mental 
institution; found incompetent to stand trial or not guilty by reason 
of insanity; or otherwise have been determined by a court, board, 
commission, or other lawful authority to be a danger to themselves or 
others or to lack the mental capacity to contract or manage their own 
affairs, as a result of marked subnormal intelligence or mental 
illness, incompetency, condition, or disease. Under this proposal, only 
covered entities with lawful authority to make adjudication or 
commitment decisions that make individuals subject to the Federal 
mental health prohibitor, or that serve as repositories of information 
for NICS reporting purposes, would be permitted to disclose the 
information needed for these purposes. This disclosure would be 
restricted to limited demographic and certain other information and 
would not include medical records, or any mental health information 
beyond the indication that the individual is subject to the Federal 
mental health prohibitor. HHS notes that the Department of Justice 
(DOJ) has proposed clarifications to the regulatory definitions 
relevant to the Federal mental health prohibitor. The DOJ proposal is 
published elsewhere in this issue of the Federal Register. While 
commenters should consider this proposed regulation in light of the 
clarifications proposed in DOJ's proposal, we note that those 
clarifications would not change how this proposed HIPAA permission 
would operate.

DATES: Submit comments on or before March 10, 2014.

ADDRESSES: Written comments may be submitted through any of the methods 
specified below. Please do not submit duplicate comments.
     Federal eRulemaking Portal: You may submit electronic 
comments at http://www.regulations.gov. Follow the instructions for 
submitting electronic comments. Attachments should be in Microsoft 
Word, WordPerfect, or Excel; however, we prefer Microsoft Word.
     Regular, Express, or Overnight Mail: You may mail written 
comments (one original and two copies) to the following address only: 
U.S. Department of Health and Human Services, Office for Civil Rights, 
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, 
Room 509F, 200 Independence Avenue SW., Washington, DC 20201.
     Hand Delivery or Courier: If you prefer, you may deliver 
(by hand or courier) your written comments (one original and two 
copies) to the following address only: Office for Civil Rights, 
Attention: HIPAA Privacy Rule and NICS, Hubert H. Humphrey Building, 
Room 509F, 200 Independence Avenue SW., Washington, DC 20201. (Because 
access to the interior of the Hubert H. Humphrey Building is not 
readily available to persons without federal government identification, 
commenters are encouraged to leave their comments in the mail drop 
slots located in the main lobby of the building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. We will post comments 
received before the close of the comment period at http://www.regulations.gov. Because

[[Page 785]]

comments will be made public, they should not include any sensitive 
personal information, such as a person's social security number; date 
of birth; driver's license number, State identification number or 
foreign country equivalent; passport number; financial account number; 
or credit or debit card number. Comments also should not include any 
sensitive health information, such as medical records or other 
individually identifiable health information, or any non-public 
corporate or trade association information, such as trade secrets or 
other proprietary information.

FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.

SUPPLEMENTARY INFORMATION: 

I. Background

    On January 16, 2013, President Barack Obama announced 23 executive 
actions aimed at curbing gun violence across the nation. Those actions 
include efforts by the Federal government to strengthen the national 
background check system, and a specific commitment to ``[a]ddress 
unnecessary legal barriers, particularly relating to the Health 
Insurance Portability and Accountability Act, that may prevent States 
from making information available to the background check system.'' The 
National Instant Criminal Background Check System (NICS) is the system 
used to determine whether a potential firearms recipient is statutorily 
prohibited from possessing or receiving a firearm. The Department 
developed this NPRM to propose a modification to the HIPAA Privacy Rule 
to permit certain covered entities to disclose to the NICS the 
identities of persons who are not allowed to possess or receive a 
firearm because they are subject to the Federal mental health 
prohibitor. The Department, through this NPRM, is soliciting public 
input on various issues, including whether it should modify the HIPAA 
Privacy Rule to permit covered entities to disclose to the NICS the 
identities of persons prohibited by State law from possessing or 
receiving a firearm for reasons related to mental health.

The National Instant Criminal Background Check System (NICS)

    The Brady Handgun Violence Prevention Act of 1993, Public Law 103-
159, and its implementing regulations, are designed to prevent the 
transfer of firearms by licensed dealers to individuals who are not 
allowed to possess or receive them as a result of restrictions 
contained in either the Gun Control Act of 1968, as amended (Title 18, 
United States Code, Chapter 44), or State law. The Gun Control Act 
identifies several categories (known as ``prohibitors'') of individuals 
\1\ who are prohibited from engaging in the shipment, transport, 
receipt, or possession of firearms, including convicted felons and 
fugitives. Most relevant for the purposes of this NPRM is the Federal 
mental health prohibitor, which, pursuant to Department of Justice 
(DOJ) regulations, applies to individuals who have been involuntarily 
committed to a mental institution, for reasons such as mental illness 
or drug use; \2\ found incompetent to stand trial or not guilty by 
reason of insanity; or otherwise have been adjudicated by a court, 
board, commission, or other lawful authority to be a danger to 
themselves or others or unable to manage their own affairs, as a result 
of marked subnormal intelligence, or mental illness, incompetency, 
condition, or disease.\3\
---------------------------------------------------------------------------

    \1\ See 18 U.S.C. 922(g) and (n) and implementing regulations at 
27 CFR 478.11 and 27 CFR 478.32.
    \2\ The regulation, at 27 CFR 478.11, defines ``Committed to a 
mental institution'' as: A formal commitment of a person to a mental 
institution by a court, board, commission, or other lawful 
authority. The term includes a commitment to a mental institution 
involuntarily, commitment for mental defectiveness or mental 
illness, as well as commitments for other reasons, such as for drug 
use. The term does not include a person in a mental institution for 
observation or a voluntary admission to a mental institution. Note 
that DOJ has proposed clarifications to this regulatory language, 
which are published elsewhere in this issue of the Federal Register.
    \3\ The term used in the statute, ``adjudicated as a mental 
defective,'' is defined by regulation to include: ``(a) A 
determination by a court, board, commission, or other lawful 
authority that a person, as a result of marked subnormal 
intelligence, or mental illness, incompetency, condition, or 
disease: (1) Is a danger to himself or to others; or (2) lacks the 
mental capacity to contract or manage his own affairs.'' The term 
includes a finding of insanity in a criminal case, and a finding of 
incompetence to stand trial or a finding of not guilty by reason of 
lack of mental responsibility pursuant to the Uniform Code of 
Military Justice. 27 CFR 478.11. Note that DOJ has proposed 
clarifications to this regulatory language, which are published 
elsewhere in this issue of the Federal Register. We also note that 
having ``marked subnormal intelligence or mental illness, 
incompetency, condition, or disease,'' is one necessary element of a 
determination that an individual (other than an individual who has 
been involuntarily committed) is subject to the Federal mental 
health prohibitor. To be subject to the Federal mental health 
prohibitor, such an individual also must be adjudicated to pose a 
danger to self or others or lack the mental capacity to contract or 
manage their own affairs.
---------------------------------------------------------------------------

    The Brady Act established the NICS to help enforce these 
prohibitions, as well as State law prohibitions on the possession or 
receipt of firearms.\4\ The NICS Index, a database administered by the 
Federal Bureau of Investigation (FBI), collects and maintains certain 
identifying information about individuals who are subject to one or 
more Federal prohibitors and thus are ineligible to purchase 
firearms.\5\ As of 2012, the NICS Index also contains information on 
persons who are subject to State law prohibitions on the possession or 
receipt of firearms. The minimum information required in a NICS Index 
record consists of: The name of the ineligible individual; the date of 
birth; sex; and codes indicating the applicable prohibitor, the 
submitting entity, and the agency record supporting the prohibition. 
For individuals subject to the Federal mental health prohibitor, only 
the fact that the individual is subject to that prohibitor is submitted 
to the NICS; underlying diagnoses, treatment records, and other 
identifiable health information are not provided to or maintained by 
the NICS. A NICS background check queries the NICS Index and certain 
other national databases \6\ to determine whether a prospective buyer's 
identifying information matches any prohibiting records contained in 
the databases. The NICS Index can be accessed only for the limited 
purposes authorized by regulation (see 28 CFR 25.6(j)) and cannot be 
used for other purposes, including general law enforcement activities.
---------------------------------------------------------------------------

    \4\ See 28 CFR 25.1 through 25.11 (establishing NICS information 
system specifications and processes) and 27 CFR part 478 
(establishing requirements and prohibitions for commerce in firearms 
and ammunition, including requirements related to conducting NICS 
background checks).
    \5\ Additionally, in 2012 the NICS Index began to include the 
identities of persons who are prohibited from possessing or 
acquiring firearms by State law, which in some cases may be more 
restrictive than Federal law. See Statement Before the Senate 
Judiciary Committee, Subcommittee on Crime and Terrorism at a 
hearing entitled, ``THE FIX GUN CHECKS ACT: BETTER STATE AND FEDERAL 
COMPLIANCE, SMARTER ENFORCEMENT'' (November 15, 2011), by David 
Cuthbertson, Assistant Director, Criminal Justice Information 
Services Division, Federal Bureau of Investigation. Testimony 
available at: http://www.justice.gov/ola/testimony/112-1/11-15-11-fbi-cuthbertson-testimony-re-the-fix-gun-checks-act.pdf.
    \6\ The other databases include the Interstate Identification 
Index, which contains criminal history record information; and the 
National Crime Information Center, which includes, e.g., information 
on persons subject to civil protection orders and arrest warrants. 
Additional information is available at, http://www.fbi.gov/about-us/cjis/nics/general-information/nics-overview.
---------------------------------------------------------------------------

    The potential transfer of a firearm from a Federal Firearms 
Licensee (FFL) to a prospective buyer proceeds as follows: First, the 
prospective buyer is required to provide personal information on a 
Firearms Transaction Record (ATF Form 4473). Unless the prospective 
buyer has documentation that he or she qualifies for an exception to 
the NICS background check

[[Page 786]]

requirement under 18 U.S.C. 922(t)(3),\7\ the FFL contacts the NICS--
electronically, by telephone, or through a State level point of 
contact--and provides certain identifying information about the 
prospective buyer from ATF Form 4473.\8\ Within about 30 seconds, the 
FFL receives a response that the prospective firearm transfer may 
proceed or is delayed. The transfer is delayed if the prospective 
buyer's information matches a record contained in one of the databases 
reviewed. If there is a match, a NICS examiner reviews the record to 
determine whether the information it contains is, in fact, prohibiting, 
and then either: (1) If the record does not contain prohibiting 
information, advises the FFL to proceed with the transaction; (2) if 
the record does contain prohibiting information, denies the transaction 
(due to ineligibility); or (3) if it is unclear based solely on the 
existing information in the record whether it is prohibiting, delays 
the transaction pending further research.\9\ The NICS examiner does not 
disclose the reason for the determination to the FFL (e.g., the FFL 
would not learn that the individual was ineligible due to the Federal 
mental health prohibitor). In case of a delay, if the NICS examiner 
does not provide a final instruction to the FFL within three business 
days of the initial background check request, the FFL may proceed with 
the transaction if it chooses to do so.\10\
---------------------------------------------------------------------------

    \7\ These exceptions are listed in the ATF regulation at 27 CFR 
478.102(d). For example, a NICS check would not be required where 
the potential recipient of a firearm has presented a valid State 
permit or license, provided conditions at 27 CFR 478.102(d)(1) are 
met.
    \8\ The form collects the prospective buyer's name; demographic 
information such as address, place and date of birth, gender, 
citizenship, race and ethnicity; and ``yes'' or ``no'' answers to 
questions about the person's criminal history and other potential 
prohibitors. The form is available at http: //www.atf.gov/forms/download/atf-f-4473-1.pdf.
    \9\ For example, a ``delay'' response may mean that further 
research is required because potentially prohibitive criteria exist, 
but the matched records are incomplete, See Federal Bureau of 
Investigation (FBI) Fact Sheet at: www.fbi.gov/about-us/cjis/nice/general-information/fact-sheet.
    \10\ Some States have waiting periods that also must be complied 
with before a firearm may be transferred, regardless of whether a 
proceed response from NICS is received by the FFL within three 
business days.
---------------------------------------------------------------------------

    Although FFLs are required in most cases to request a background 
check through the NICS before transferring a firearm to a prospective 
buyer,\11\ Federal law does not require State agencies to report to the 
NICS the identities of individuals who are prohibited from purchasing 
firearms, and not all States report complete information to the NICS or 
the databases checked by it. Following the shooting at Virginia Tech 
University in 2007, and other tragedies involving the illegal use of 
firearms, Congress enacted the NICS Improvement Amendments Act (NIAA) 
of 2008, Public Law 110-180. Among other provisions, the NIAA requires 
Federal agencies to make accessible to the NICS the identities of 
individuals known by the agencies to be subject to one or more 
prohibitors, and it authorizes incentive grants for States to provide 
such information when it is in their possession.\12\ In addition, some 
States enacted legislation requiring the reporting of the identities of 
ineligible individuals to databases accessible to the NICS or to a 
State level repository responsible for submitting information to the 
relevant databases. Although the States generally report criminal 
history and related information to the appropriate FBI-maintained 
databases that are checked by the NICS, many States continue to report 
little if any information to the NICS Index, so the NICS does not have 
access to complete information about all individuals who are subject to 
one or more of the Federal prohibited categories or prohibited from 
possessing or receiving firearms under State law.\13\
---------------------------------------------------------------------------

    \11\ See 27 CFR 478.102. Exceptions to this requirement are 
referenced in FN 7 above, and listed in the regulation at 27 CFR 
478.102(d).
    \12\ Eligibility for these grants is limited to States that have 
implemented a relief from disabilities program for individuals who 
are prohibited from possessing or receiving firearms for mental 
health reasons. Such programs must provide that a State court, 
board, commission, or other lawful authority shall grant the relief 
if, based on the circumstances regarding the disabilities and the 
person's record and reputation, the person is not likely to pose a 
danger to public safety, and granting the relief would not be 
contrary to the public interest. See Public Law 110-180, Section 
105.
    \13\ The same is true of the other two databases accessed during 
a NICS Check, the III and NCIC. State participation and reporting to 
those databases is also not required.
---------------------------------------------------------------------------

The HIPAA Privacy Rule and NICS Reporting

    The Privacy Rule, promulgated under the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA), Title II, Subtitle 
F--Administrative Simplification, Public Law 104-191, establishes 
federal protections to ensure the privacy and security of protected 
health information and establishes an array of individual rights with 
respect to one's own health information. HIPAA applies to covered 
entities, which include health plans, health care clearinghouses, and 
health care providers that conduct certain standard transactions (such 
as billing insurance) electronically. HIPAA covered entities may only 
use and disclose protected health information with the individual's 
written authorization, or as otherwise expressly permitted or required 
by the HIPAA Privacy Rule.
    The Privacy Rule seeks to balance individuals' privacy interests 
with important public policy goals including public health and safety. 
In doing so, the Privacy Rule allows, subject to certain conditions and 
limitations, uses and disclosures of protected health information 
without individuals' authorization for certain law enforcement 
purposes, to avert a serious threat to health or safety, and where 
required by State or other law, among other purposes. See 45 CFR 
164.512.
    As stated above, individuals who are subject to the Federal mental 
health prohibitor are ineligible to purchase a firearm because they 
have been ``committed to a mental institution'' or ``adjudicated a 
mental defective'', 18 U.S.C. 922(g)(4). DOJ regulations define these 
categories to include persons who have been involuntarily committed to 
a mental institution for reasons such as mental illness or drug use; 
have been found incompetent to stand trial or not guilty by reason of 
insanity; or otherwise have been adjudicated by a court, board, 
commission, or other lawful authority to be a danger to themselves or 
others or unable to manage their own affairs, as a result of marked 
subnormal intelligence, or mental illness, incompetency, condition, or 
disease.\14\ Records of individuals adjudicated as incompetent to stand 
trial, or not guilty by reason of insanity, originate with entities in 
the criminal justice system, and these entities are not HIPAA covered 
entities. Likewise, involuntary civil commitments usually are made by 
court order, and thus, records of such formal commitments typically 
originate with entities in the justice system. In addition, many 
adjudications determining that individuals pose a danger to themselves 
or others, or are incapable of managing their own affairs, occur 
through a legal process in the court system.
---------------------------------------------------------------------------

    \14\ As noted above, DOJ has proposed clarifications to the 
regulatory language relevant to these two categories; the DOJ 
proposal is published elsewhere in this issue of the Federal 
Register.
---------------------------------------------------------------------------

    However, because of the variety of State laws, there may be State 
agencies, boards, commissions, or other lawful authorities outside the 
court system that are involved in some involuntary commitments or 
mental health adjudications that make an individual subject to the 
Federal mental health prohibitor. Moreover, we understand that some 
States have designated repositories to collect and report to the

[[Page 787]]

NICS the identities of individuals subject to the Federal mental health 
prohibitor. We currently do not have sufficient data to determine to 
what extent any of these lawful authorities or repositories also may be 
a HIPAA covered entity (e.g., a State health agency).
    Even in circumstances where records are subject to HIPAA--for 
example, where the record of an involuntary commitment or mental health 
adjudication originates with a HIPAA covered entity, or the HIPAA 
covered entity is the State repository for such records--there are ways 
in which the Privacy Rule permits the reporting to the NICS. In 
particular, the Privacy Rule permits the covered entity to disclose the 
information to the NICS to the extent the State has enacted a law 
requiring (not merely authorizing) such reporting.\15\ Alternatively, 
where there is no State law requiring reporting, the Privacy Rule 
permits a HIPAA covered entity that performs both health care and non-
health care functions (e.g., NICS reporting) to become a hybrid entity 
and thus, have the HIPAA Privacy Rule apply only to its health care 
functions. The entity achieves hybrid entity status by designating its 
health care components as separate from other components, documenting 
that designation, and implementing policies and procedures to prevent 
unauthorized access to protected health information by the entity's 
non-covered components. Thus, an entity that has designated itself a 
hybrid entity, in accordance with the Privacy Rule,\16\ can report 
prohibitor information through its non-HIPAA covered NICS reporting 
unit without restriction under the Privacy Rule.
---------------------------------------------------------------------------

    \15\ See 45 CFR 164.512(a). Note that disclosures for NICS 
purposes would not fall under the Privacy Rule's provisions 
permitting disclosures for law enforcement purposes (which apply to 
specific law enforcement inquiries) or to avert a serious threat to 
health or safety (which require an imminent threat of harm). See 45 
CFR 164.512(f) and (j).
    \16\ See 45 CFR 164.103, 164.105.
---------------------------------------------------------------------------

    However, many States still are not reporting to the NICS essential 
information on persons prohibited from possessing firearms for reasons 
related to mental health. Thus, concerns have been raised that the 
HIPAA Privacy Rule's restrictions on covered entities' disclosures of 
protected health information may be preventing certain States from 
reporting the relevant information to the NICS. Further, in July 2012, 
the U.S. Government Accountability Office (GAO) reported to Congress on 
the results of a survey of six States that it had assessed as part of a 
performance audit of the progress made by DOJ and the States in 
implementing the NIAA.\17\ In the report, the GAO wrote that, ``. . . 
officials from 3 of the 6 States we reviewed said that the absence of 
explicit State-level statutory authority to share mental health records 
was an impediment to making such records available to NICS.'' \18\ The 
report also stated that, although the number of records provided by the 
States to the NICS had increased by 800 percent between 2004 and 2011, 
this increase was largely due to efforts by only 12 States. The report 
raised the possibility that States that do not report to the NICS the 
identities of individuals who are prohibited from possessing firearms 
for reasons related to mental health may experience challenges to 
reporting related to the HIPAA Privacy Rule.
---------------------------------------------------------------------------

    \17\ See GAO-12-684, Gun Control: Sharing Promising Practices 
and Assessing Incentives Could Better Position Justice to Assist 
States in Providing Records for Background Checks.
    \18\ We note that the GAO Report uses the term ``mental health 
records'' to refer to identifying information on individuals who are 
subject to the Federal mental health prohibitor. To avoid implying 
that mental health records are collected by NICS, the Department 
uses the terms ``identities,'' ``information,'' or ``data'' in place 
of ``mental health records.'' GAO-12-684, p. 12.
---------------------------------------------------------------------------

II. The ANPRM

Background

    On April 23, 2013, the Department published an Advance Notice of 
Proposed Rulemaking (ANPRM) requesting public input on these issues (78 
FR 23872). The ANPRM explained that the Department was considering 
creating an express permission in the HIPAA Privacy Rule for reporting 
information relevant to the Federal mental health prohibitor to the 
NICS by those HIPAA covered entities responsible for involuntary 
commitments or the adjudications that would subject individuals to the 
Federal mental health prohibitor, or that are otherwise designated by 
the States to report to the NICS. In the ANPRM, the Department 
indicated that such an amendment might produce clarity regarding the 
Privacy Rule and help make it as simple as possible for States to 
report the identities of such individuals to the NICS.
    The ANPRM stated that, in crafting the elements of an express 
permission, the Department would consider limiting the information to 
be disclosed to the minimum information necessary for NICS purposes, 
such as the names of the individuals who are subject to the Federal 
mental health prohibitor, demographic information such as dates of 
birth, and codes identifying the reporting entity and the relevant 
prohibitor. We indicated that the NICS does not include, and we would 
not consider permitting the disclosure of, an individual's treatment 
record or any other clinical or diagnostic information for this 
purpose. In addition, we would consider permitting disclosures for NICS 
purposes only by those covered entities that order involuntary 
commitments, perform relevant mental health adjudications, or are 
otherwise designated as State repositories for NICS reporting purposes.
    To inform our efforts to address any issues in this area, we 
requested comments on a series of questions concerning the nature and 
scope of the problem of underreporting. The questions included:
     The nature and extent of States' participation in NICS 
reporting;
     To what extent HIPAA is perceived as a barrier to 
reporting, and specific examples of situations in which reporting to 
the NICS is hindered by HIPAA requirements;
     Steps States may have taken to address HIPAA challenges 
for reporting, including any statutory or regulatory changes at the 
State level;
     Whether States had designated any HIPAA covered agencies 
as repositories of information for NICS reporting purposes and, if so, 
how the States have addressed HIPAA requirements while reporting;
     Whether certain HIPAA covered entities in the States have 
authority to order involuntary commitments or perform other 
adjudications that make an individual subject to the Federal mental 
health prohibitor;
     Whether additional, non-HIPAA related barriers to 
reporting exist;
     Whether there are privacy protections in place for data 
collected for NICS reporting purposes, and whether or how State public 
records laws would apply to the information;
     Whether creating an express permission would have 
implications for treatment, and whether there would be ways to mitigate 
any unintended consequences of creating such a permission; and
     How HHS could disseminate information or provide 
additional guidance on the HIPAA Privacy Rule to address confusion 
about HIPAA that may affect reporting to the NICS.
    We requested comments from all stakeholders on these issues, 
including HIPAA covered entities; agencies of State, territorial, and 
tribal governments; law enforcement officials; individuals; and 
consumer advocates and groups.

[[Page 788]]

III. Public Comments on the ANPRM

Introduction

    The Department received over 2,050 comments in response to the 
ANPRM. Commenters included individuals, State agencies, health care 
providers, professional organizations, consumer advocacy groups, and 
other stakeholders.
    Individuals generally expressed concern that the NICS, the Federal 
mental health prohibitor, and the contemplated HIPAA permission, would 
infringe on their Second Amendment right to bear arms and the right to 
be afforded due process of law under the U.S. Constitution
    Many individual commenters, as well as health care providers, 
organizations representing providers, and consumer advocacy groups, 
emphasized the importance of protecting individuals' health information 
privacy and raised concerns regarding the possible adverse consequences 
an express permission could have on the patient-provider treatment 
relationship and individuals' willingness to seek needed mental health 
care. Other commenters supported the proposal as removing a perceived 
barrier to an important and necessary public safety measure. Four State 
agencies and several organizations representing State officials and 
State-based professional organizations responded to the specific 
questions in the ANPRM regarding how NICS reporting occurs in those 
specific States and their perceptions of HIPAA-related barriers or 
other challenges related to NICS reporting. We discuss these comments, 
along with others, in more detail below.

Summary of Comments and Responses

A. Concerns Regarding the NICS and the Federal Mental Health Prohibitor

    As noted above, a majority of individual commenters voiced general 
concern that NICS reporting would lead to infringements on individuals' 
rights to bear arms and to receive due process of law under the 
Constitution. Some commenters voiced opposition to any restriction on 
their right to bear arms.
    Many commenters raised concerns with the Federal mental health 
prohibitor category itself. Some, while supportive of the general 
proposition that individuals who pose a risk of harm to themselves or 
others should not have access to firearms, expressed concern that the 
Federal mental health prohibitor was overly broad and would result in 
individuals being reported to the NICS Index who do not pose a threat 
to society. A number of these commenters expressed concern regarding 
the standard used to determine whether individuals should be reported 
to the NICS, including those adjudicated as ``lack[ing] the mental 
capacity to contract or manage his own affairs'' under 27 CFR 478.11. 
Several commenters were especially concerned that the prohibitor might 
include individuals who are adjudicated as temporarily unable to 
independently manage their Veterans or Supplemental Security Income 
(SSI) benefits.
    Further, many commenters asserted that mental illness is not an 
effective predictor of gun violence, and that there is no direct 
correlation between reporting individuals with mental illnesses to the 
NICS Index and a reduction in gun violence. Several commenters added 
that studies have shown that individuals with mental disorders are more 
likely to be the victims of violent crime by others than the 
perpetrators. In addition, some commenters specifically objected to 
individuals that fall within the Federal mental health prohibitor being 
reported to the NICS on the grounds that the NICS is a ``criminal'' 
database.
    Many commenters expressed concerns about whether individuals who 
are subject to the Federal mental health prohibitor receive due 
process. For example, many individuals were concerned that an 
individual would be reported to the NICS without a formal adjudication 
through the judicial system. A few commenters argued that any 
determination that would subject an individual to the Federal mental 
health prohibitor should include a review by one or more mental health 
professionals. In general, commenters urged the Department to allow 
reporting of only those involuntary commitments that involve due 
process of law.
    State officials and many other commenters emphasized the importance 
of establishing mechanisms to remove an individual's name from the NICS 
when the basis for their inclusion no longer applies. Some of these 
commenters also expressed concern about the difficulty, including the 
cost and time involved, of getting an erroneous submission removed from 
the NICS database. Several commenters noted that individuals whose 
conditions or circumstances change would not have a process to seek 
removal from the NICS.
    A few commenters suggested that, in addition to the minimum 
information currently needed to report an individual to the NICS, 
covered entities should also be permitted to disclose the date of the 
disqualifying event. This, they asserted, would make it easier for 
individuals to determine whether the report was made erroneously.
    We acknowledge the concerns of these commenters. However, this 
proposed rule would not affect the scope of the NICS or the Federal 
mental health prohibitor. Rather, the rule is intended to address 
perceptions that HIPAA creates a barrier to entities reporting 
information to the NICS. More specifically, it would create a way in 
which covered entities involved in reporting or collecting NICS data 
may disclose, consistent with the Privacy Rule, the information needed 
for NICS reporting. It will not expand the categories of prohibited 
persons or modify other Federal or State laws pertaining to firearms 
purchases, but would be limited to those covered entities that 
currently perform the adjudications that make individuals subject to 
the Federal mental health prohibitor, or that collect information 
regarding such adjudications on behalf of a State.
    Further, the Department clarifies that the proposed HIPAA 
permission for NICS reporting would be limited to reporting of 
individuals who are subject to the Federal mental health prohibitor, as 
defined in Federal law and regulations. DOJ regulations state that this 
would not include individuals in a mental institution for observation 
or admitted voluntarily. See 27 CFR 478.11 (Definitions).\19\ Thus, 
individuals who are subject to the Federal mental health prohibitor are 
afforded the opportunity for judicial review or other due process.
---------------------------------------------------------------------------

    \19\ DOJ has proposed clarifications to 27 CFR 478.11. The DOJ 
proposal is published elsewhere in this issue of the Federal 
Register. The proposed regulatory text would not alter this aspect 
of the definition of ``committed to a mental institution.''
---------------------------------------------------------------------------

    We acknowledge the commenters' concerns with respect to 
opportunities for remediation and note that individuals who believe 
they are wrongly denied the purchase of a firearm can visit https://forms.fbi.gov/nics-appeals-request-form to find out more information 
and appeal their denial. Further, some States have implemented programs 
providing for relief from disabilities under the Federal mental health 
prohibitor. Relief from disabilities is a process by which an 
individual, who would otherwise be prohibited from purchasing a firearm 
under the Federal mental health prohibitor, may apply to the lawful 
authority in the State where the commitment or adjudication occurred 
for relief. The lawful authority must grant relief if it can be 
established that the circumstances regarding the disability and the 
applicant's record and reputation are such that the applicant

[[Page 789]]

will not be likely to act in a manner dangerous to public safety, and 
the granting of relief would not be contrary to the public interest. 
States' processes for granting relief vary.

B. Comments Regarding NICS Reporting Barriers and Creating an Express 
Permission in the HIPAA Privacy Rule

1. State Processes for Reporting to the NICS
    Health agencies from three States responded to the ANPRM's specific 
questions regarding NICS reporting in those States. An official from 
the Washington State Department of Social and Health Services explained 
that a HIPAA covered State agency had been responsible for reporting to 
the NICS until 2009, when a new State law transferred reporting 
responsibility to the State's Administrative Office of the Courts. 
Officials from the Colorado Department of Health Care Policy and 
Financing and the North Carolina Department of Health and Human 
Services stated that non-HIPAA covered entities in those States are 
responsible for reporting to the NICS (the State Bureau of 
Investigation and the county Clerks of Court, respectively). Three of 
the State agency commenters added that entities in their States also do 
not experience any other, non-HIPAA related, barriers to reporting to 
the NICS.
2. Creating an Express Permission
    Two of the State agency commenters agreed with our statement in the 
ANPRM that creating an express permission in HIPAA for disclosures to 
the NICS would resolve any perceived ambiguity and be generally 
beneficial. Several other commenters agreed, and asserted that an 
individual's right to the privacy of his or her medical records should 
not be placed ahead of the safety and welfare of the population as a 
whole. A few commenters noted that HIPAA was intended to protect the 
privacy of individuals' health information, not to protect individuals 
from being identified as potential threats to others.
    In addition, the Law Center to Prevent Gun Violence reported that, 
while a majority of States have enacted laws relating to reporting 
information to the NICS or a State repository, HIPAA continues to be 
cited as a perceived barrier to reporting to the NICS in a number of 
States. This commenter suggested that the perception of a barrier may 
arise because HIPAA's permission for uses and disclosures that are 
required by law would not permit HIPAA covered entities to disclose 
information for NICS purposes in States that have enacted laws 
authorizing, but not requiring, such reporting. Further complicating 
disclosures to the NICS, according to this commenter, is the fact that 
at least eleven States rely, at least in part, on a mental health 
facility to report information on individuals in a prohibited category. 
This commenter reported that all of those States have statutes 
requiring such reporting, but noted that some of the State laws only 
require reporting to State repositories, and not to the NICS database. 
Finally, the National Center for State Courts asserted that reporting 
to the NICS by entities in a State's judicial system can be challenging 
due to varying interpretations as to whether or when HIPAA may affect 
such reporting. This commenter felt an express permission under HIPAA 
would help resolve this perceived ambiguity.
    Some commenters agreed that, if a permission were created, HIPAA's 
minimum necessary provisions should apply to any disclosures for 
reporting to the NICS database. These commenters appreciated the 
Department's assurance that an individual's treatment record, or any 
other clinical or diagnostic information, is not needed for the NICS, 
and we would not consider permitting the disclosure of such information 
under a proposed rule.
    In addition, several commenters urged that any HIPAA exception be 
limited to reporting of ``commitments'' as defined by 27 CFR 478.11, as 
these commenters noted, there exists a great variance under State law 
as to what constitutes a commitment. Several commenters requested 
clarification on what constitutes a commitment under the Federal mental 
health prohibitor. One commenter specifically urged the Department to 
not amend the HIPAA Privacy Rule until the DOJ revises the Gun Control 
Act regulations to clarify the standards under which an individual 
becomes subject to a statutory prohibitor.\20\
---------------------------------------------------------------------------

    \20\ We note that DOJ has proposed clarifications to the 
relevant regulations defining the categories of persons who are 
prohibited from possessing firearms. The DOJ proposal is published 
elsewhere in this issue of the Federal Register.
---------------------------------------------------------------------------

    A number of commenters argued that the proposed permission was 
unnecessary, some agreeing with the ANPRM's statement that HIPAA's 
existing permissions (e.g., for uses and disclosures required by State 
law) largely permit NICS reporting to take place. However, it should be 
noted that several commenters expressed, and thus may have based their 
comments on, the misconception that the Privacy Rule's permission to 
disclose for public health purposes, law enforcement purposes, or to 
prevent a serious and imminent threat, currently allow for disclosures 
to the NICS. As we noted in the ANPRM, NICS reporting would not be 
consistent with the conditions the HIPAA Privacy Rule places on such 
uses and disclosures. See conditions listed at 45 CFR 164.512(b), (f), 
and (j).
    Many commenters believed a change to the Privacy Rule to be 
unnecessary because the information generally is reported to the NICS 
by non-HIPAA covered entities. One commenter pointed out that, even in 
States that allow mental health providers to commit individuals without 
prior adjudication, in which case a HIPAA covered provider might be the 
sole possessor of certain information related to the Federal mental 
health prohibitor, such information eventually must be shared with the 
court system, usually within a designated timeframe. This commenter and 
others argued that it would be more appropriate for a court system, 
rather than providers, to report information for NICS purposes. A few 
commenters suggested that, where records relevant to the Federal mental 
health prohibitor are not available to a judicial agency, another State 
agency or a State's Office of Attorney General should be responsible 
for reporting.
    Some commenters were opposed to the creation of any express 
permission. Many mental health advocates and individual commenters 
voiced concern that an express HIPAA permission for reporting to the 
NICS information relevant to the Federal mental health prohibitor would 
reinforce and exacerbate the stigma surrounding mental illness. In 
addition, many commenters expressed concern that creating an express 
permission to disclose information for NICS purposes would harm the 
patient-provider relationship and discourage some individuals from 
seeking needed mental health treatment, due to fear that their doctor 
might disclose otherwise confidential communications about particularly 
sensitive information, such as mental health treatment information. 
Some commenters expressed particular concern that a change to the 
Privacy Rule would adversely affect veterans by deterring individuals 
with post traumatic stress disorder (PTSD) and other mental health 
issues from seeking mental health services for fear of losing their 
firearms.
    After considering the comments we received, we agree that the 
creation of an express permission in the HIPAA Privacy Rule to disclose 
information relevant to the Federal mental health prohibitor for NICS 
purposes is

[[Page 790]]

necessary to address ambiguity and ensure relevant information can be 
reported for this important public safety purpose. Thus, as discussed 
more fully below, we propose to permit certain covered entities to 
disclose limited information for NICS reporting purposes.
    It is important to note that a mental health diagnosis does not, in 
itself, make an individual subject to the Federal mental health 
prohibitor, which requires an involuntary commitment or adjudication 
that the individual poses a danger to self or others or lacks the 
mental capacity to contract or manage their own affairs. For example, 
with respect to the Federal mental health prohibitor, concerns about 
veterans being reported to the NICS based solely on a diagnosis of PTSD 
are misplaced. Still, we acknowledge commenters' concerns about 
possible detrimental effects of an express NICS disclosure provision on 
individuals' relationships with their health care providers, or on 
individuals' willingness to seek care in the first place. We agree that 
encouraging individuals to obtain appropriate treatment is critical to 
both individuals' health and the public's safety. Therefore, we have 
narrowly drawn this proposed permission such that it would not apply to 
the vast majority of treating health care providers, who do not perform 
the formal involuntary commitments or other adjudications that make an 
individual subject to the Federal mental health prohibitor, and do not 
serve as repositories of information about such commitments and 
adjudications. Those health care providers do not report to the NICS 
currently and this would not change under the proposed rule.
    The Department has carefully tailored the proposed permission to 
generally apply to entities that are not directly involved in treatment 
to minimize any potential adverse unintended consequences, such as 
discouraging individuals from seeking mental health treatment due to 
concerns that their provider might report them to the NICS. Instead, as 
we explain more fully below in the description of the rule, only those 
HIPAA covered entities that conduct the involuntary commitments or 
other adjudications that make an individual subject to the Federal 
mental health prohibitor, or that serve as repositories of information 
about such adjudications, would be permitted to rely on the proposed 
express permission to disclose information for NICS reporting 
purposes.\21\
---------------------------------------------------------------------------

    \21\ We note that other provisions of the HIPAA Privacy Rule 
that permit covered entities to disclose information for public 
policy purposes remain in effect. Thus, where a HIPAA covered 
entity, including an entity not falling within the proposed 
provision, is required by law to disclose to the NICS, such 
disclosures would continue to be permitted under the Privacy Rule.
---------------------------------------------------------------------------

    The Department is soliciting comment on whether the permission 
should instead be broad enough to also include reporting of persons to 
the NICS who are subject to State firearm prohibitions, in light of the 
many State laws that restrict firearms possession for mental health 
related reasons. It is possible that extending the permission in this 
way would expand the number of potential reporting entities to include 
more covered entities that provide treatment. We describe the potential 
implications of expanding the scope of the permission to include State 
law prohibitors more fully below.
    In addition, the proposed provision would permit those entities to 
disclose only the minimum necessary information for NICS reporting 
purposes. NICS does not access or maintain diagnostic or clinical 
information, so such information would not be considered the minimum 
necessary. The Department is soliciting comment on whether to permit 
the disclosure of certain additional identifying information (but not 
to include diagnostic or clinical information) that would help the NICS 
make accurate matches or rule out matches based on the additional 
information. These additional identifiers are discussed below in the 
description of the proposed rule.
    We believe that the proposed change would appropriately protect and 
preserve individuals' privacy interests, the patient-provider 
relationship, and the public's health and safety. We emphasize that 
most covered entities, including treating providers who do not also 
perform formal involuntary commitments or other adjudications that make 
an individual subject to the Federal mental health prohibitor, as well 
as business associates, will not be disclosing information about 
individuals directly to the NICS under this proposal. We expect most 
reporting to continue to be done by the judicial system. However, where 
the judicial system lacks the information needed, or where the judicial 
system is not the appropriate entity to report individuals to the NICS, 
this proposal, if finalized, will give States and covered entities 
additional flexibility to ensure accurate information is reported to 
the NICS.

C. Other Comments

1. Privacy, Security, and Uses of NICS Information
    A few commenters requested information on whether information in 
the NICS can be accessed by government officials for purposes other 
than firearm purchase background checks. In addition, some commenters 
raised concerns regarding the privacy and security protections afforded 
to information reported to the NICS, including protections for that 
information when held by States and while in transit.
    The relevant regulations permit NICS background checks in 
conjunction with the transfer of a firearm, issuance of firearm or 
explosives permits or licenses, as well as in conjunction with ATF 
civil or criminal law enforcement investigations relating to the Gun 
Control Act or National Firearms Act. See 28 CFR 25.6(j).\22\ The NICS 
cannot be used for purposes beyond those articulated in the governing 
regulations, including for general law enforcement activities.
---------------------------------------------------------------------------

    \22\ See Gun Control Act, 18 U.S.C. Chapter 44; National 
Firearms Act, 26 U.S.C. Chapter 53; see also 28 CFR 25.6(j), 63 FR 
58303, 58308-58309.
---------------------------------------------------------------------------

    The DOJ regulations make clear that FFLs can initiate NICS 
background checks only in connection with a firearm transaction 
requiring a NICS background check. FFLs are prohibited from initiating 
a query to the NICS for any other purpose. Further, when an individual 
prohibited from possessing a firearm attempts to obtain a firearm from 
an FFL, the FFL receives a response indicating only that the transfer 
has been denied or delayed pending further review, but does not have 
access to information about the applicable prohibitor or any other 
additional information regarding the reason for the delay or denial.
    With respect to the privacy and security of information reported 
for NICS purposes, the DOJ has established policies and procedures for 
ensuring the privacy and security of NICS data in its possession, 
including physical security and safeguards, such as access 
restrictions. Further, the DOJ requires State and local law enforcement 
agencies involved in conducting background checks to observe certain 
security policies and procedures when processing NICS background 
checks.
    Finally, in response to a question in the ANPRM about the 
confidentiality of information that has been collected by a repository 
for NICS reporting, several commenters, including officials from North 
Carolina, Washington, and

[[Page 791]]

Colorado, indicated that the individually identifiable information 
collected for NICS reporting could not be made publicly available under 
State public records laws. Further, we note that to the extent a HIPAA 
covered entity is maintaining and reporting information relevant to the 
Federal mental health prohibitor that is protected health information 
(including demographic information), such entities must continue to 
protect the information in accordance with the HIPAA Privacy and 
Security Rules, which includes ensuring appropriate safeguards to 
protect the information as it is maintained and transmitted.
2. Improving the Current Mental Health System and Enforcement of Other 
Laws
    Several commenters recommended better tracking of firearms and 
better enforcement of existing laws in place of a HIPAA modification. 
Other commenters urged the Department to focus on improving the current 
mental health care system in order to reduce gun violence associated 
with mental illness.
    The Department continues to support efforts by the Administration 
to dispel stigmas relating to mental illness and to encourage 
individuals to seek voluntary mental health treatment. With the 
implementation of the Affordable Care Act, millions of Americans who 
did not previously have coverage will receive coverage for mental 
health services. Additionally, the Administration has improved access 
to mental health services for veterans and has supported initiatives to 
train more mental health professionals and help educators recognize 
students showing signs of mental illness and refer them to appropriate 
services.
3. Application of a HIPAA Permission to Other Prohibitors
    Several commenters requested clarification on whether disclosures 
for NICS reporting under the proposed rule would be limited to the 
Federal mental health prohibitor or if covered entities could disclose 
protected health information related to any of the Federal prohibitors 
under the Gun Control Act. Some other commenters recommended that the 
Department amend the HIPAA Privacy Rule to expressly permit such 
reporting with respect to all of the Federal prohibitors. A few 
commenters also urged the Department to extend any express permission 
under the HIPAA Privacy Rule for NICS reporting to include prohibitor 
categories that State laws have enacted, which may extend beyond the 
Federal prohibitors. Some commenters suggested creating a provision 
permitting reporting related to other factors they perceive as 
associated with gun violence, such as domestic violence and substance 
abuse.
    The Department does not propose to expand the proposed permission 
to apply to information about individuals who are subject to the other 
prohibitors listed at 18 U.S.C. 922. HIPAA covered entities are 
unlikely to have information related to the other Federal prohibitors, 
with the possible exception of the drug use prohibitor, for which we 
understand criminal records to be the primary source of information for 
the NICS. We note that, to the extent that individuals' drug use 
results in their being involuntarily committed, those individuals would 
be subject to the Federal mental health prohibitor and this proposed 
permission would apply.
    Some States have enacted their own laws prohibiting the possession 
or receipt of firearms for reasons related to mental health and may 
prohibit the purchase or possession of a firearm by additional 
individuals who are not otherwise subject to the Federal mental health 
prohibitor. For example, some States may temporarily prohibit firearm 
possession by individuals who have voluntarily committed themselves to 
inpatient treatment, which currently does not make an individual 
subject to the Federal mental health prohibitor. As noted above, some 
States currently collect and report to the NICS the identities of 
individuals who are subject to State prohibitors, as well as the 
Federal prohibitors. To the extent that States have enacted their own 
prohibitions related to mental health, State law may also reduce 
barriers by requiring reporting to the NICS by those making the mental 
health assessments that make individuals subject to a State 
prohibition. However, the Department requests comment on whether HIPAA 
is perceived as a barrier to reporting to the NICS information about 
individuals who are subject to State law firearm prohibitions and 
whether the final rule should address this barrier.
    Although the NICS has a role in helping to enforce State firearms 
prohibitions intended to keep firearms out of the hands of certain 
individuals for reasons related to mental health, the NICS Index 
currently does not contain information about all individuals who are 
subject to such prohibitions. The Department seeks comment on whether 
the proposed permission should be broadened to include information 
relevant to those State law prohibitions, as well as information 
relevant to the Federal mental health prohibitor. Expanding the 
permission would ensure that relevant State law prohibitor information 
could be reported to NICS in States that do not otherwise require the 
reporting. At the same time, however, there are implications to 
expanding the permission to encompass State law prohibitors, which may 
be broader than the Federal mental health prohibitor. For example, if 
more entities in States with their own prohibitors have the authority 
to make determinations that subject individuals to a firearms 
prohibition, there would be an increased likelihood that more treating 
providers would be permitted to report information to the NICS. In 
addition, there may be State laws that prohibit the possession or 
receipt of a firearm by individuals with particular mental health 
diagnoses or an assessment of ``dangerousness'' with correspondingly 
different procedural protections for individuals. The Department is 
seeking comment on whether these concerns are borne out in any States 
and whether the proposed permission should be broadened to include 
information relevant to those State law prohibitions.
4. Notice
    A few commenters asked whether individuals would be notified if 
their provider disclosed their protected health information for NICS 
reporting purposes. If such notification were not required, commenters 
recommended that there be a way for individuals to find out that their 
provider disclosed their information for such purposes. One commenter 
asked whether covered entities would be required to revise their Notice 
of Privacy Practices to inform individuals that the entities might make 
disclosures for NICS reporting purposes.
    We are not proposing new notification requirements.\23\ Further, 
the Department would not require covered entities to revise their 
Notices of Privacy Practices to specifically reference this new 
provision. Existing notices that more generally refer to the types of 
disclosures each covered entity is permitted to make, including 
disclosures for the public policy purposes under 45 CFR 164.512, would 
suffice.
---------------------------------------------------------------------------

    \23\ We note that individuals who have tried to purchase a 
firearm and been denied can appeal to the FBI (and, in some States, 
to the NICS Point of Contact for the State), and learn the reason 
for the denial, if they believe they have been erroneously reported.
---------------------------------------------------------------------------

5. HHS Authority
    Several commenters argued that any amendment to HIPAA to provide an 
express permission for reporting to the NICS database should be passed 
by

[[Page 792]]

Congress, not created by HHS. These commenters argued that the 
Administration would overstep its authority if it adopted a regulatory 
change that Congress chose not to enact and that this would violate the 
principle of separation of powers. Additionally, several commenters 
argued that under the principle of federalism, regulation of firearms 
should be left to the States.
    We note that Congress, when it enacted HIPAA, provided the 
Department with general authority to determine the permissible uses and 
disclosures of covered entities and modify the HIPAA standards as 
appropriate. It is under this authority that the Department has 
proposed to modify the Privacy Rule to permit certain disclosures for 
the purpose of NICS reporting.
6. Additional Guidance
    Several commenters asked for additional guidance materials, 
training, and other outreach efforts from the Department to help 
covered entities, State agency officials, State legislatures, and State 
judiciaries better understand HIPAA's permitted and required 
disclosures. Some commenters specifically cited HIPAA as a perceived 
barrier to State legislatures passing laws requiring NICS reporting due 
to misconceptions about HIPAA preempting State law, and requested that 
the Department conduct outreach to explain HIPAA's preemption 
provisions. Other commenters urged the Department to increase its 
outreach efforts to encourage individuals to seek voluntary mental 
health services.
    The Department anticipates issuing guidance to both address 
misconceptions (e.g., such as the perception that HIPAA is a barrier to 
State legislatures passing laws requiring reporting) and to help 
covered entities comply with the rule. With respect to the latter, we 
intend to work with DOJ to issue additional guidance on the categories 
within the Federal mental health prohibitor,\24\ variations in State 
law, and when and how the HIPAA permission would apply. We will 
continue to evaluate additional areas that may benefit from further 
guidance.
---------------------------------------------------------------------------

    \24\ We note that DOJ has proposed clarifications to the 
regulatory definitions relevant to the Federal mental health 
prohibitor. The DOJ proposal is published elsewhere in this issue of 
the Federal Register.
---------------------------------------------------------------------------

    Finally, the Department will continue its efforts to increase 
access to, and utilization of, needed mental health care services.

IV. Overview of the Proposed Rule

    We are proposing to revise 45 CFR 164.512 of the Privacy Rule by 
adding a new category of permitted disclosures to 45 CFR 164.512(k), 
which addresses uses and disclosures for specialized government 
functions. The new provisions at (k)(7) would permit certain covered 
entities to disclose the minimum necessary demographic and other 
information for NICS reporting purposes, which would not include 
clinical, diagnostic, or other mental health information.
    There is a strong public safety need for this information to be 
accessible to the NICS, and some States are currently under-reporting 
or not reporting this information at all. From what we understand, and 
what we have heard from commenters, most of the information relevant to 
the Federal mental health prohibitor is held by entities that are not 
covered by HIPAA. For those few HIPAA covered entities that may be 
involved in the relevant commitments or adjudications, the Privacy Rule 
contains paths for disclosure, but these do not appear to be 
sufficient. Therefore, we propose to add another, narrowly tailored, 
permission for HIPAA covered entities that perform the commitments or 
adjudications that make individuals subject to the Federal mental 
health prohibitor, or that act as repositories of NICS records on 
behalf of a State, to use and disclose certain information for NICS 
reporting purposes. To the extent that some covered entities may 
perform adjudicatory or repository functions in States that have not 
enacted laws requiring reporting to the NICS, and a subset of those may 
be unable to achieve hybrid entity status for administrative or other 
reasons, this permission would remove a barrier to their reporting and 
provide clarity. Importantly, the proposed permission would focus on 
those entities performing the relevant commitment, adjudicatory or 
repository functions, not on those performing solely treatment 
functions.
    We note that the proposed modification to the Privacy Rule would 
merely permit, and not require, covered entities to report to the NICS. 
In addition, it would not place additional limitations on or otherwise 
affect the currently existing permitted uses and disclosures of 
protected health information under the Privacy Rule. Thus, for example, 
the Rule's current permissions for uses and disclosures required by 
other law, including State law, would remain unchanged, as would 
provisions permitting uses and disclosures for law enforcement purposes 
as part of a specific investigation, or to avert a serious and imminent 
threat. See 45 CFR 164.512(a), (f), and (j).

V. Description of the Proposed Rule

    The following describes the specific provisions of the proposed 
rule. Those interested in commenting on the proposed rule can assist 
the Department by preceding discussion of any particular topic with a 
citation or reference to the aspect of the proposed rule being 
discussed. While we request comment on several specific questions, we 
welcome comments on any aspect of the proposed rule.

General Rule

    Paragraph (k)(7) would permit uses and disclosures of protected 
health information for purposes of reporting to the NICS or a State-
designated entity the identities of individuals who are subject to the 
Federal mental health prohibitor under 18 U.S.C. 922(g)(4), provided 
the conditions in the remaining paragraphs under (k)(7) are met. We do 
not intend with this paragraph to require formal designations by the 
States, but we would expect States to be able to identify the 
responsible entity. We request comment on whether the proposed language 
encompasses all entities that are responsible for reporting to, or 
otherwise collecting information for, the NICS on behalf of the States.
    The proposed permission would not permit covered entities to use or 
disclose the protected health information of individuals who are 
subject to one or more of the other prohibitors listed at 18 U.S.C. 
922(g), as the lack of an express HIPAA permission for reporting 
information relevant to the Federal mental health prohibitor is a 
limited problem and we have not heard that there is a similar issue 
with respect to the other prohibitors. Thus, for example, a covered 
entity would not be able to use this permission to use or disclose 
information about an individual who is an unlawful user of or addicted 
to any controlled substance (18 U.S.C. 922(g)(3)), except to the extent 
the individual is also subject to the Federal mental health prohibitor. 
We note that other laws may impact disclosures related to the other 
prohibitors, including 18 U.S.C. 922(g)(3).
    We propose to limit the permission to uses and disclosures about 
individuals who are subject to the Federal mental health prohibitor. As 
discussed above, we request comment on the scope of the permission, 
specifically with regard to whether the permission should be

[[Page 793]]

broadened to allow covered entities to disclose the identities of 
individuals who are prohibited by Federal or State law from possessing 
or receiving firearms for reasons related to mental health.

Applicability

    Paragraph (k)(7)(i) would apply the express permission only to 
covered entities that function as repositories of information relevant 
to the Federal mental health prohibitor on behalf of a State, or that 
are responsible for ordering the involuntary commitments or other 
adjudications that make an individual subject to the Federal mental 
health prohibitor. The Federal prohibitor regulations define an 
involuntary commitment as a formal commitment of a person to a mental 
institution by a court, board, commission, or other lawful authority. 
It does not apply to individuals in a psychiatric facility for 
observation or who have been admitted voluntarily. The other applicable 
adjudications include determinations by a court, board, commission, or 
other lawful authority that persons are a danger to themselves or 
others, or lack the mental capacity to contract or manage their own 
affairs, as a result of marked subnormal intelligence, or mental 
illness, incompetency, condition, or disease. See 27 CFR 478.11 
(Definitions).\25\ This NPRM refers to the involuntary commitments and 
other applicable adjudications as, collectively, ``adjudications that 
make an individual subject to the Federal mental health prohibitor.''
---------------------------------------------------------------------------

    \25\ Note that DOJ has proposed clarifications to this 
regulation; the DOJ proposal is published elsewhere in this issue of 
the Federal Register.
---------------------------------------------------------------------------

    Our understanding is that lawful authority for performing such 
adjudications and repository functions rests, for the most part, with 
entities that operate outside the scope of HIPAA. However, in the 
interest of public safety, we want to ensure that relevant 
adjudications can be reported in the small subset of States in which 
HIPAA covered entities may make, or collect and report records of, 
these determinations.
    In permitting only entities involved in these adjudicatory or 
repository/reporting functions to use or disclose Federal mental health 
prohibitor information for NICS purposes, the proposal would not create 
a permission for most treating providers to disclose protected health 
information about their own patients for these purposes. We agree with 
the commenters who argued that encouraging voluntary treatment is 
critical to ensuring positive outcomes for individuals' health as well 
as the public's safety. We also agree with the many commenters who 
asserted that non-health care entities should and currently do bear 
primary responsibility for collection and reporting of information 
relevant to the Federal mental health prohibitor in most States. 
However, where a HIPAA covered entity is a board, commission, or other 
lawful authority that makes adjudications that result in individuals 
being subject to the Federal mental health prohibitor, we believe those 
entities are most likely to hold records of the relevant adjudications.
    We request public comment on the extent to which some States may 
have vested responsibility for Federal mental health prohibitor 
reporting in HIPAA covered entities, to what extent records needed for 
NICS reporting are created or maintained by covered entities, and 
whether there are circumstances in which health care providers would 
need to report the identity of an individual subject to the Federal 
mental health prohibitor to a State designated records repository or 
directly to the NICS. We also request comment on the types of 
additional guidance from OCR and/or the NICS that would be helpful for 
understanding to which covered entities, and under what circumstances, 
the proposed permission would apply.

Recipients of Information Disclosures

    Paragraph (k)(7)(ii) would provide that a covered entity identified 
in (k)(7)(i) may use or disclose Federal mental health prohibitor 
information for NICS purposes either directly to the NICS or to an 
entity designated by the State as a repository of data for purposes of 
reporting to the NICS. By clearly delimiting the permitted recipients 
of such disclosures, the rule would ensure that covered entities do not 
exceed the intended scope of the permission by disclosing information 
relevant to the Federal mental health prohibitor to, for example, law 
enforcement agencies that do not operate as repositories of data for 
purposes of reporting to the NICS. Again, as stated above, the Privacy 
Rule's existing permissions to use or disclose protected health 
information for specific law enforcement investigations, as provided in 
45 CFR 164.512(f), would remain unchanged. We request comment on 
whether there are States in which a type of entity not described in 
this proposed paragraph is responsible for NICS reporting and needs to 
be able to receive NICS data from a HIPAA covered entity.

Limitations on the Information Used or Disclosed

    Paragraph (k)(7)(iii) would strictly limit the information used or 
disclosed for NICS reporting purposes to the minimum necessary for such 
purposes. The Privacy Rule requires uses and disclosures of protected 
health information to be limited to the minimum necessary for their 
intended purpose, and in the proposed regulation text, we make clear 
that only limited demographic and other information would constitute 
the minimum necessary for NICS reporting. At this time, we would 
consider the minimum necessary information to include an individual's 
name; date of birth; sex; a code or notation indicating that the 
individual is subject to the Federal mental health prohibitor; a code 
or notation representing the reporting entity; and a code identifying 
the agency record supporting the prohibition. The proposed modification 
would not permit the use or disclosure of clinical or diagnostic 
information for NICS reporting purposes. We request comment on whether, 
and in what circumstances, HIPAA covered entities or other entities 
such as courts currently report to a records repository or directly to 
the NICS information that is not listed in the proposed paragraph.
    We are also considering permitting the disclosure of some or all 
the following additional data elements, which are optional fields for a 
NICS Index entry, as part of the minimum necessary for NICS reporting 
purposes: Social Security number, place of birth, State of residence, 
height, weight, eye color, hair color, and race. From what we 
understand, these elements are not included in every NICS record, but 
often are used to confirm that a prospective firearm recipient matches 
a record searched by the NICS or to eliminate ``false positive'' 
background check results. We request public comment on this issue.

VI. Regulatory Analyses

A. Introduction

    We have prepared a regulatory impact statement in compliance with 
Executive Order 12866 (September 1993, Regulatory Planning and Review), 
Executive Order 13563 (January 2011, Improving Regulation and 
Regulatory Review), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), the Unfunded Mandates Reform Act of 1995 (UMRA) 
(March 22, 1995, Pub. L. 104-4), and Executive Order 13132 on 
Federalism.

[[Page 794]]

1. Executive Order 12866 and Executive Order 13563
    Executive Orders 12866 and 135643 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). Executive 
Order 135634 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This rule has been designated a ``significant regulatory 
action'' although not economically significant, under section 3(f) of 
Executive Order 12866. Accordingly, this rule has been reviewed by the 
Office of Management and Budget.
    A regulatory impact analysis must be prepared for all major rules 
that have economically significant effects ($100 million or more in any 
one year) or adversely affect in a material way the economy, a sector 
of the economy, productivity, competition, jobs, the environment, 
public health or safety, or State, local, or tribal government or 
communities (58 FR 51741). Because the proposed rule does not contain 
any new requirements for covered entities, we estimate that the rule 
will be cost neutral. We request comment on our assumptions and 
information on the nature of any unanticipated costs that covered 
entities may incur as a result of the rule.
    Although we expect the economic impact of the rule, including non-
quantifiable costs and savings discussed in the regulatory analysis 
below, to be less than $100 million annually, we nevertheless conducted 
an analysis of the costs of the proposed rule.
2. Entities Subject to the Rule
    This proposed rule would apply only to covered entities that are 
responsible for ordering involuntary commitments or conducting other 
adjudications that make individuals subject to a Federal prohibition 
against possessing firearms under 18 U.S.C. 922(g)(4) (the Federal 
mental health prohibitor), or that are otherwise designated by a State 
to report the identities of such individuals to the NICS. We do not 
have sufficient data to determine the number of affected entities, but, 
based on the information available to us, we believe there would be 
very few. Our understanding is that, for the most part, formal 
adjudications and repository functions of this nature are conducted by 
entities, such as court systems or law enforcement agencies, that are 
not covered by HIPAA. We welcome public comment on the number of 
covered entities that might be affected by this rule.

B. Why is this rule needed?

    This proposed rule is needed to ensure that, where HIPAA covered 
entities make adjudications causing individuals to become subject to 
the Federal mental health prohibitor, or serve as repositories of 
records of such adjudications on behalf of States, those covered 
entities can report the identities of those individuals to the NICS. 
Specific permission under the Privacy Rule for these disclosures is 
necessary to the extent that some States have not enacted laws 
requiring reporting to the NICS, but a covered entity in the State is 
nevertheless responsible for such reporting. Importantly, the proposed 
rule would permit only a small subset of HIPAA covered entities (i.e., 
those that perform the relevant mental health adjudications or 
repository functions) to use or disclose only limited, non-clinical 
information, for NICS purposes. This narrowly tailored permission would 
permit these important uses or disclosures for public safety to occur 
while maintaining a separation between reporting functions and the 
mental health treatment a patient might be receiving.

C. Qualitative Analysis of Unquantified Costs

    The rule would be cost neutral with respect to HIPAA covered 
entities. The rule would not require entities that already have a NICS 
reporting process in place to change their current system and would not 
create new reporting or recordkeeping requirements for any covered 
entity. The small number of covered entities that would be newly 
permitted to report to the NICS or a State repository under the rule 
could begin reporting and may need to develop policies and procedures 
to do so. As the Privacy Rule only allows the use or disclosure of 
information, and does not require it, any resulting burden of reporting 
and associated procedures is attributable to the Federal statutory 
mental health prohibitor and the NICS system itself. See 28 CFR Part 
25, Subpart A (http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&tpl=/ecfrbrowse/Title28/28cfr25_main_02.tpl ). We acknowledge that those 
entities that choose to begin reporting may wish to address this change 
in their HIPAA policies and procedures, as well as explain their 
procedures to office staff. However, the rule would not require any 
changes to existing HIPAA policies and procedures. In addition, with 
respect to training, the rule would not require workforce training 
beyond what is already required under the HIPAA Privacy and Security 
Rules, and we do not expect that such entities that choose to report 
under the rule would do more than ensure that their office staff have 
copies of the new policies and procedures. We request comment on these 
assumptions and on the number of entities that might begin to report to 
the NICS for the first time, if any.
    To the extent that the rule would permit some covered entities to 
report to the NICS for the first time, there may be an increase in the 
number of individuals whose identities are newly included in the NICS 
and who are denied a firearm transfer as a result. As a result, there 
may be a concomitant increase in applications for relief from 
disabilities in states that provide such a relief program. However, any 
burden to individuals completing and submitting the relief application 
form is attributed to the procedures established by the State where the 
commitment or adjudication occurred. The procedures for applying for 
relief in States that have established mental health relief from 
disabilities programs pursuant to the NICS Improvement Amendments Act 
of 2007 vary. We received a number of comments on the ANPRM asserting 
that creating an express permission in the Privacy Rule for NICS 
reporting would discourage individuals from seeking needed mental 
health care. We appreciate these concerns and agree with commenters who 
asserted that individuals' health and the public's safety are best 
served by encouraging appropriate treatment. We also recognize that 
discouraging treatment could increase the burden of untreated mental 
conditions to individuals, in the form of increased suffering and loss 
of productivity; to the health care system, when individuals with 
untreated mental illness need emergency hospitalization, for example; 
and to the public's safety. However, the majority of these commenters 
expressed the mistaken belief that the proposed permission would allow 
or require mental health care providers to report diagnostic or 
clinical information to the NICS. Many of these commenters also voiced 
concern that an express permission under HIPAA would potentially 
increase burdens on providers. Although one commenter suggested that an 
express permission under HIPAA would help lessen concerns about 
provider liability for disclosures related to NICS reporting, many more 
commenters expressed concern that

[[Page 795]]

creating an express permission might lead providers to over report 
their patients due to a fear of liability for failing to report a 
patient who later commits an act of gun violence.
    As explained above, we have carefully and narrowly tailored the 
proposed rule to apply only to a small number of covered entities that 
may be responsible for the adjudications that make an individual 
subject to the Federal mental health prohibitor, or that serve as 
repositories of data about such adjudications. As such, the proposed 
rule generally would maintain a separation between treatment functions 
and NICS reporting functions. In addition, the rule would not permit 
the use or disclosure of any diagnostic or clinical information, or any 
other information about an individual that is not the minimum necessary 
for NICS reporting purposes. Because of these strict limitations on the 
permitted uses and disclosures, we believe that individuals would not 
be dissuaded from seeking needed mental health care services as a 
result of the proposed rule. We welcome comment on this assumption.
    Finally, we recognize the intangible burden to individuals of the 
stigma associated with mental health conditions. We again emphasize, as 
we did in the ANPRM, that individuals with treated mental health 
conditions as a group have not been shown to pose an increased risk of 
gun violence against others compared with the general population, and 
are in fact more likely to be victims of violence than other members of 
the general population. We note further that the Federal mental health 
prohibitor does not apply to all individuals with mental health 
conditions, but instead a subset of individuals who have been 
involuntarily committed or otherwise adjudicated to be a danger to 
themselves or others, or unable to manage their own affairs, as a 
result of marked subnormal intelligence, or mental illness, 
incompetency, condition, or disease. With this proposed rule, the 
Department is not adopting or endorsing the idea that individuals with 
mental health conditions pose a danger to society. Rather, the rule 
would permit a limited number of HIPAA covered entities to report to 
the NICS the identities of individuals in a particular subcategory of 
persons who are currently prohibited by Federal law from possessing 
firearms. This permission would facilitate the enforcement of 
prohibitions that were established by the Gun Control Act. Therefore, 
we do not expect that this proposed rule would exacerbate stigma 
associated with mental health conditions.
    We request comment on this assumption and on any other costs that 
may be associated with the rule.

D. Qualitative Analysis of Unquantified Benefits

    While we believe that there may be benefits to public safety as a 
result of the rule, we are not able to monetize the value of such 
benefits.
    For example, the rule may result in increased reporting to the NICS 
of individuals who may pose a risk of gun violence related to a serious 
mental health condition. To the extent that this rule would permit 
covered entities to report those individuals' identities for NICS 
purposes, resulting in denial of firearms to those who are prohibited 
from possessing firearms under Federal law, the rule would provide a 
public safety benefit. However, we do not have information about 
whether, or how many, covered entities would begin to report or 
increase reporting to the NICS as a result of the rule.
    An additional benefit of the rule would be to alleviate the 
concerns of State lawmakers who, according to a handful of commenters, 
may be reluctant to pursue legislation requiring entities to report 
Federal mental health prohibitor information for NICS purposes because 
of a misconception that the HIPAA Privacy Rule would preempt such 
requirements. As explained more fully above, the Privacy Rule permits 
uses and disclosures that are required by law. To the extent that State 
lawmakers harbor this misconception, this rule would serve both to 
clarify HIPAA's preemption provisions and provide an avenue for NICS 
reporting that may obviate a need to enact legislation at the State 
level.
    We welcome comment on any of these issues.

E. Additional Regulatory Analyses

1. Regulatory Flexibility Act
    The RFA requires agencies to analyze and consider options for 
reducing regulatory burden if a rule will impose a significant burden 
on a substantial number of small entities. The act requires the head of 
the agency to either certify that the rule would not impose such a 
burden or perform a regulatory flexibility analysis and consider 
alternatives to lessen the burden. For the reasons explained more fully 
above in the summary of costs and benefits, it is not expected that the 
rule would result in compliance costs for covered entities of any size 
because the rule would not impose new requirements.
2. Unfunded Mandates Reform Act
    Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates would require spending in any one year 
$100 million in 1995 dollars, updated annually for inflation. In 2013, 
that threshold is approximately $150 million dollars. UMRA does not 
address the total cost of a rule. Rather, it focuses on certain 
categories of cost, mainly those ``Federal mandate'' costs resulting 
from: (1) Imposing enforceable duties on State, local, or Tribal 
governments, or on the private sector; or (2) increasing the stringency 
of conditions in, or decreasing the funding of, State, local, or Tribal 
governments under entitlement programs. As this proposed rule would not 
impose enforceable duties or affect entitlement programs, UMRA does not 
require us to prepare an analysis of the costs and benefits of the 
rule. Nonetheless, we have done so in accordance with Executive Orders 
12866 and 13563, and present this analysis in sections C and D above.
3. Federalism
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a rule that imposes substantial 
direct requirement costs on State and local governments, preempts State 
law, or otherwise has Federalism implications.
    The Federalism implications of the HIPAA Privacy and Security Rules 
were assessed as required by Executive Order 13132 and published as 
part of the preambles to the final rules on December 28, 2000 (65 FR 
82462, 82797) and February 20, 2003 (68 FR 8334, 8373), respectively. 
This proposed rule would not impose requirements, or any associated 
costs, on State and local governments. Regarding preemption, the 
preamble to the final Privacy Rule explained that the HIPAA statute 
dictates the relationship between State law and Privacy Rule 
requirements. Therefore, the Privacy Rule's existing preemption 
provisions do not raise Federalism issues, and these provisions would 
not be affected by this proposed rule. In addition, we again emphasize 
that the proposed modification to the rule would not require covered 
entities to make disclosures that are prohibited by State law, nor 
would it prevent disclosures required by State law. For these reasons, 
the rule would not have Federalism implications.

[[Page 796]]

F. Accounting Statement

    Whenever a rule is considered a significant rule under Executive 
Order 12866, we are required to develop an accounting statement 
indicating the costs associated with the rule. As explained above in 
the RIA, we expect that the rule would be cost neutral. However, we 
invite comment on potential costs associated with the rule, including 
costs to covered entities that choose to amend written HIPAA policies 
and procedures or train staff.

VII. Collection of Information Requirements

    This proposed rule does not contain new requirements for 
information collections (i.e., reporting, recordkeeping, and third-
party disclosures) under the Paperwork Reduction Act.

List of Subjects in 45 CFR Part 164

    Administrative practice and procedure, Computer technology, 
Electronic information system, Electronic transactions, Employer 
benefit plan, Health, Health care, Health facilities, Health insurance, 
Health records, Hospitals, Medicaid, Medical research, Medicare, 
Privacy, Reporting and recordkeeping requirements, and Security.

    For the reasons set forth in the preamble, the Department of Health 
and Human Services proposes to amend 45 CFR Subtitle A, Subchapter C, 
part 164, as set forth below:

PART 164--SECURITY AND PRIVACY

0
1. The authority citation for part 164 continues to read as follows:

    Authority: 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, 
Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)); and 
secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279.

0
2. Amend Sec.  164.512 by adding paragraph (k)(7) to read as follows:


Sec.  164.512  Uses and disclosures for which an authorization or 
opportunity to agree or object is not required.

* * * * *
    (k) * * *
    (7) National Instant Criminal Background Check System. A covered 
entity may use or disclose protected health information for purposes of 
reporting to the National Instant Criminal Background Check System the 
identity of an individual who is prohibited from possessing a firearm 
under 18 U.S.C. 922(g)(4), provided the covered entity:
    (i) Is a State agency or other entity that is, or contains an 
entity that is:
    (A) An entity designated by the State to report, or which collects 
information for purposes of reporting, on behalf of the State, to the 
National Instant Criminal Background Check System; or
    (B) A court, board, commission, or other lawful authority that 
makes the commitment or adjudication that causes an individual to 
become subject to 18 U.S.C. 922(g)(4).
    (ii) Discloses the information to:
    (A) The National Instant Criminal Background Check System; or
    (B) An entity designated by the State to report, or which collects 
information for purposes of reporting, on behalf of the State, to the 
National Instant Criminal Background Check System; and
    (iii) (A) Discloses only the limited demographic and certain other 
information needed for purposes of reporting to the National Instant 
Criminal Background Check System; and
    (B) Does not disclose diagnostic or clinical information for such 
purposes.
* * * * *

    Dated: December 31, 2013.
Kathleen Sebelius,
Secretary.
[FR Doc. 2014-00055 Filed 1-3-14; 4:15 pm]
BILLING CODE 4153-01-P