Regulating the Intersection of Health Care and Gun Control

As part of the White House response to the Sandy Hook Elementary School tragedy, President Barack Obama emphasized the importance of preventing access to guns “for those who would commit acts of violence.” In order to accomplish that objective, the Administration announced that it would engage the regulatory process to close loopholes in the background check system for purchasing firearms. Among other initiatives, the president’s program called for removing unnecessary obstacles that preclude states from reporting relevant data to the federal background check system. In response, both the U.S. Department of Health and Human Services (HHS) and the Department of Justice (DOJ) issued notices of proposed rulemaking early last year concerning categories of individuals barred from weapons possession under the Gun Control Act of 1968. Among the groups prohibited by that law from receiving firearms or ammunition are persons who have “been adjudicated as a mental defective” or “committed to a mental institution.” These terms, known in combination as the “federal mental health prohibitor,” are further defined by DOJ regulations. The National Incident Criminal Background Check System (NICS) provides the operational vehicle for ensuring that prohibited individuals are not allowed to purchase guns. It was established by the Brady Handgun Violence Prevention Act of 1993 to help enforce the prohibitions in the 1968 law. Administered by the Federal Bureau of Investigation (FBI), the NICS Index is a database of identifying information about individuals subject to federal or state bans on gun purchases. Before completing a firearms sale, a federal firearms licensee – the licensed gun dealer – must query the NICS to find out if the transaction may proceed. The NICS background check searches three national databases, including the NICS Index, for any prohibitive criteria and provides a rapid response to the federal firearms licensee to continue or delay the firearm transfer. The NICS Improvement Amendments Act (NIAA) of 2008, enacted shortly after the Virginia Tech tragedy, mandated that federal agencies transmit relevant information to the NICS and also encouraged states to do so via a grants system. State participation nonetheless remains voluntary. The proposed rule issued by HHS last year as part of the president’s plan sought to address state concerns that reporting information to the NICS, especially with respect to mental health, could run afoul of restrictions under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the federal health information privacy regulation. As such, HHS proposed amending its HIPAA Privacy Rule to expressly allow certain HIPAA-covered entities to disclose identifying information to the NICS about individuals subject to the federal mental health prohibitor. Notably, such routine disclosures would not otherwise fall under an existing HIPAA exception to avert a serious threat to health or safety, since that provision requires a showing of “an imminent threat of harm.” HHS has proposed a “narrowly tailored” permission intended to allay hesitancy among states to report necessary protected health information to the NICS. Yet the actual impact of this permission would likely be minimal, given that the vast majority of state agencies performing adjudicatory or repository functions relevant to the federal mental health prohibitor are “entities that operate outside the scope of HIPAA.” In contrast, the health care providers, plans, and clearinghouses that are subject to HIPAA rarely possess the authority to make determinations that are reportable to the NICS. For example, involuntary psychiatric commitments and findings of incompetency involve substantial due process considerations outside the purview of treating health care providers. Nonetheless, the main benefit of HHS’s proposed rule change could be to counteract misconceptions that may be discouraging NICS reporting at the state level due to fear of HIPAA violations. Meantime, a proposed rule published by DOJ would make several clarifications to the mental health prohibitor itself. Most notably, the proposal would underscore that commitment to a mental institution for purposes of the Gun Control Act “includes both inpatient and outpatient treatment” when ordered involuntarily by an appropriate legal authority. Voluntary admissions and temporary holds for observation or evaluation remain outside the definition so as not to discourage individuals from seeking mental health treatment. Involuntary commitment still requires a formal adjudication, but the proposed modification emphasizes that the resulting placement may be on either an inpatient or outpatient basis. Importantly, neither the HHS nor DOJ proposed rule would change certain fundamental principles, such as “that a mental health diagnosis does not, in itself,” trigger the federal mental health prohibitor. The prohibitor is tied to determinations subject to judicial review or other similar due process protections (although the sufficiency of the due process afforded in various adjudicatory venues can certainly be debated). Moreover, the NICS Index includes certain identifying and demographic data on individuals ineligible for gun transfers, not the diagnostic or clinical records underlying their status. In keeping with HIPAA’s “minimum necessary” standard, even permitted disclosures to the NICS by health care entities would be limited to the information needed to accomplish the reporting function. The very nature of health information privacy regulation makes it an unwieldy vehicle for implementing gun control initiatives. Although misconceptions about HIPAA abound and can thereby cause reluctance to release information even when allowed, actual changes to the HIPAA Privacy Rule are unlikely to have major substantive effects on reporting of patient information by health care providers. The reason for this lies in the structure of HIPAA itself. The HIPAA Privacy Rule “provides a federal floor,” not a ceiling, of privacy protections. When states enact “more stringent” provisions, as is often the case with treatments or diagnoses deemed especially sensitive, HIPAA defers to state law. Furthermore, for alcohol and substance abuse programs subject to strict federal confidentiality regulations, compliance with both HIPAA and the confidentiality rules generally means continuing to follow the latter. Finally, although gun violence reduction efforts frequently focus on mental health, the Privacy Rule is largely agnostic as to whether protected health information is classified as medical or psychiatric. With the exception of a psychotherapist’s desk-drawer “psychotherapy notes,” the Privacy Rule does not provide extra protections for mental, as compared to physical, health information. Those additional restrictions are left to the province of state legislatures, to whose judgment the HIPAA regulations afford deference. Thus, even when clarifications or modifications to the HIPAA Privacy Rule permit disclosure in specified circumstances, doctors and hospitals must be wary of other applicable laws or professional standards that “may impose stricter limitations.” Since the vast majority of releases allowed by HIPAA are permissive rather than mandatory, the natural inclination of covered entities is often to err on the side of nondisclosure. Given that the HIPAA Privacy Rule permits disclosures of health information explicitly required by law, the most effective mechanism for surmounting HIPAA concerns is ultimately to summon the political will to seek statutory or regulatory mandates compelling the production of information. In such cases, HIPAA facilitates disclosure in compliance with and limited to the requirements of the relevant law. This strategy requires an honest and informed discussion of whether, and to what extent, mental illness is even a reliable predictor of violent behavior. Most importantly, it focuses the debate on the central issue: not the information practices of health care providers, but the situations in which the law should affirmatively require reporting