On January 4th, President Obama released a series of executive actions to reduce gun violence, including a final rule from the Department of Health and Human Services.  This final rule amends HIPAA’s Privacy Rule to “remove unnecessary legal barriers preventing States from reporting relevant information about people prohibited from possessing a gun for specific mental health reasons.”


The federal Gun Control Act of 1968 has categories of people prohibited from gun ownership, including any individual “who has been adjudicated a mental defective or who has been committed to a mental institution.”  Commitment under this law refers to involuntary commitment and excludes voluntary admission or admission for observation.  (Note that there are pending regulations to modify the term “mental defective.”)

The Brady Handgun Violence Prevention Act of 1993 established the National Instant Criminal Background Check System (NICS), and required those purchasing guns from federally licensed firearms dealers to first pass a background check. Run by the FBI, gun sellers must run prospective buyers through this system to see if the buyer is disqualified from owning a gun. Participation in NICS is voluntary; states are not required to provide names of individuals prohibited from gun ownership due to mental health issues.

In 2008, Congress passed the NICS Improvement Amendments Act. Among other things, this law created financial incentives to improve reporting to the NICS those individuals prohibited from gun ownership due to mental health issues. However, states were still not reporting, due in large part to privacy concerns such as HIPAA. Under the Privacy Rule, releases of patient information for governmental purposes and law enforcement can only be made if “required [not just allowed] by law.” At my last count, only 23 states “require” reporting to NICS.

In 2013, President Obama signed 23 executive orders addressing gun violence, including HHS’ amendment to the Privacy Rule to increase NICS reporting. Three years later, that amendment was published in today’s Federal Register.


HIPAA’s Privacy Rule § 164.512 “Uses and disclosures for which an authorization or opportunity to agree or object is not required” is amended to add a new section (k)(7) which says:

(7) National Instant Criminal Background Check System.  A covered entity may use or disclose protected health information for purposes of reporting to the National Instant Criminal Background Check System the identity of an individual who is prohibited from possessing a firearm under 18 U.S.C. 922(g)(4) [the mental health prohibitions] provided the covered entity:

(i)  Is a State agency or other entity that is, or contains an  entity that is:

(A) An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; or

(B) A court, board, commission, or other lawful authority that makes the commitment or adjudication that causes an individual to become subject to 18 U.S.C. 922(g)(4); and

(ii)  Discloses the information only to:

(A)  The National Instant Criminal Background Check System; or

(B)  An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; and

(iii)         (A)  Discloses only the limited demographic and certain other information needed for purposes of reporting to the National Instant Criminal Background Check System; and

(B)  Does not disclose diagnostic or clinical information for such purposes.


– There is no new reporting requirement created under this amendment.

– The amendment explicitly permits the pre-existing reports to be made without violating HIPAA.

– Not every psychiatrist who involuntarily commits an individual will have to make a report to NICS.

– NICS reporting is done by the State, and typically by the mental health facility rather than by an individual physician.

– Some states prohibit such reporting.

– Not every individual with a mental health diagnosis is affected by this law.

– From HHS’ comments: “…we emphasize…that a mental health diagnosis does not, in itself, make an individual subject to the Federal mental health prohibitor, which requires an involuntary commitment or adjudication that the individual poses a danger to self or others or lacks the mental capacity to contract or manage his other own affairs….the Federal mental health prohibitor, which applies only where an individual has been involuntarily committed or otherwise has received a relevant adjudication from a court, board, commission, or other lawful authority…”

– The covered entities making the report are few.

– Some state have entities other than covered entities responsible for the reporting

– For example, California law requires mental health facilities to report involuntary commitments to the state DOJ; the state DOJ then makes the report to NICS

– From HHS’ comments:

– “…limiting the permission to those covered entities that also perform an adjudicatory or data repository function.”

– “This final rule applies only to covered entities that function as repositories of information relevant to the Federal mental health prohibitor on behalf of a State or that are responsible for ordering the involuntary commitments or other adjudications that make an individual subject ot the Federal mental health prohibitor….Our understanding is that, for the most part, formal adjudications and repository functions of this nature are conducted by entities, such as court systems or law enforcement agencies, that are not covered by HIPAA.”

– This is only federal law – state law could prohibit such disclosures.

– From HHS’ comments: “…because the Privacy Rule, as modified by this final rule, only permits (but does not require) the disclosure for NICS reporting, State laws that prohibit such disclosures are not contrary to the Privacy Rule, and covered entities in States with such laws remain subject to any applicable prohibitions against disclosures under State law.”

For more information about the mental health prohibitions on gun ownership, and information on restoration of gun rights, I can highly recommend a chapter I co-authored, along with Dr. Liza Gold, in Gun Violence and Mental Illness (APPI, 2015).

This blog has also been cross-posted on LinkedIn.


Donna Vanderpool, MBA, JD – Vice President As Vice President of Risk Management, Ms. Vanderpool is responsible for the development and implementation of PRMS’s risk management services for The Psychiatrists’ Program. Ms. Vanderpool has developed expertise in the areas of HIPAA and forensic practice, and has consulted, written and spoken nationally on these and other healthcare law and risk management topics. She most recently contributed to a chapter in Gun Violence and Mental Illness (APPI), authored chapters on telepsychiatry in Mental Health Practice in a Digital World (Springer) and Psychoanalysis Online 2 (Karnac). She also has co-edited and contributed chapters to several other clinical textbooks. Prior to joining PRMS in 2000, Ms. Vanderpool practiced criminal defense law, taught business and legal courses, and spent eight years managing a general surgical practice. Ms. Vanderpool received a Bachelor’s degree in Business Administration and Management from James Madison University. She also earned a Master of Business Administration degree and Juris Doctor degree from George Mason University. Follow Donna on LinkedIn.


Categories: PRMS Blog, HIPAA