What Obama’s gun rule means to you

Responding to several executive actions taken by President Obama this year, the U.S. Department of Health and Human Services (HHS) issued a final rule[i] effectuating regulations that already existed around gun laws and reporting requirements. The regulations legally disqualify certain individuals with mental health histories from transporting, possessing or receiving a firearm.[ii]

Prior to the final rule, HIPAA lacked the practical means of identifying those individuals. Because of this, the firearm prohibition regulation essentially was toothless.[iii]

Under the final rule from HHS, providers and others are in fact permitted to disclose certain, otherwise private health information under HIPAA—without patient authorization—to the National Instant Criminal Background Check System (NICS) maintained by the Federal Bureau of Investigation. Prior to the final rule, the HIPAA Privacy Rule[iv] permitted disclosure of individually identifiable health information, or “protected health information” (PHI), without written authorization from the patient only in certain specific circumstances such as law enforcement situations or threat of immediate health or safety.

None of the HIPAA exceptions permitted disclosure to the NICS without authorization.

Many clinical providers err on the side of caution when considering disclosing PHI. Seeking authorization from patients for these purposes is often burdensome, harmful to the patient-provider relationship, ineffective and a deterrent to care.[v] Hence, the firearm prohibition law was largely without effect until the final rule was promulgated recently.[vi]

Careful balance

The final rule is intended to mitigate the perception to individuals seeking help for mental health issues that their private mental health information may be exposed to authorities or that seeking help might preclude them from exercising their Second Amendment rights to keep and bear arms. HHS acknowledged a careful balance was required between encouraging mental health treatment and patient privacy with public safety concerns. To achieve this balance—and incidentally, likely prevent Second Amendment constitutional challenges[vii]—HHS narrowly tailored the scope of the proposed rule. The department also intended to satisfy the compelling governmental interest for public safety.

For instance, according to HHS, the final rule will not apply to all entities that handle mental health patient information because that would have been too broad of a sweep. It could have resulted in discrimination against persons with mental health disorders that have no causal relation to an increased risk of violence or misusing a firearm.

HHS limited the type of qualifying entities permitted to disclose patient information without authorization to the background check system. Such qualified entities include, but are not limited to:

• Entities that are “designated by the state;”
• Repositories of information for NICS reporting purposes; or
• Certain entities with lawful authority that determine whether individuals are subject to the firearm prohibition or that collect information for the purpose of disclosing private health information to NICS.

These qualifying entities include state agencies, boards, commissions or other lawful authorities, state level repositories, hybrid entities (performing a combination of healthcare and adjudicative functions or NICS reporting), or any covered entity in a state that requires disclosure to NICS or its repositories.[viii] Some states have specifically designated repositories. Yet, repositories and qualified entities may be a broad term states use to identify any entity with information relevant for NICS purposes.

Under the final rule, each state may designate the types of entities that are permitted to disclose PHI to NICS without patient authorization. Due to the final rule and the HHS comments, there may be an increase in requests for PHI for NICS reporting purposes. This is especially likely in those states where a repository is “required” under state law to collect and report identities of those subject to the firearm prohibition.[ix]

A covered entity includes healthcare providers under HIPAA. Entities should be prepared to determine when disclosure without authorization is appropriate. The status or designation of the entity, however, is not the only consideration.

Information disclosed

The final rule does not apply to individuals in a psychiatric facility who have been admitted voluntarily or for observation because it would otherwise discourage voluntary treatment. The final rule does apply to those committed involuntarily or involved in mental health “adjudications.”

The information to be disclosed for applicable circumstances will include only the name, gender, date of birth and identifying codes.

Politically, the perceived balance struck was appreciated by the American Medical Assn. and American Psychiatric Assn., as each entity expressed more support for the final rule than the prior proposed rules.[x] Yet, HHS may have left some room for states to broaden, or attempt to broaden, application of the final rule.

Related: The least you need to know about the gun control executive order

It remains to be seen whether:

• The final rule will be upheld;
• Just how narrow in practice the NICS disclosing entities will be; and
• How or whether covered entities will be “qualified.”

Treatment facilities beware

The final rule permits disclosure to NICS without patient authorization. HIPAA, however, only creates the floor when it comes to regulations, with 42 CFR Part 2 (Part 2) requiring more stringent protections and standards for disclosure.

In the comments, HHS said that Part 2 may preclude or prevent disclosure by federally-assisted alcohol and drug abuse treatment facilities under the new regulations.[xi]  The comment published by HHS[xii] is notable because it indicates Part 2 likely supersedes the final rule.[xiii] It was buried in a footnote, which is hardly an emphasis on a potentially crucial point for many providers, specifically, federally assisted substance abuse treatment facilities.

The final rule could impact federally assisted substance abuse treatment facilities if states try to designate some of them as repositories of information for NICS reporting purposes or “qualified entities.” Even when requests from state authorities to treatment centers cite to state and federal law apparently compelling disclosure, federally funded substance abuse treatment facilities should seek legal counsel before disclosing PHI without authorization.

Part 2 preempts state privacy rules where the state is silent or the state laws are less stringent. Many states have passed laws “requiring” disclosure under particular circumstances for a number of reasons. Often these requirements are conflict-preempted by Part 2.[xiv]

A federally funded substance abuse treatment facility is likely subject to Part 2, not the final rule or a state requirement for disclosure of PHI. States very well may attempt to broaden the scope of the federal final rule or purport to require disclosure of PHI from federally funded substance abuse treatment facilities for NICS purposes.

It is up to the substance abuse facility to understand its privacy obligations under Part 2 even in the face of government requests.

Three bodies of law

Generally speaking, federally-assisted substance abuse treatment facilities may be subject to three bodies of law in understanding and evaluating disclosure of PHI:

1. HIPAA;
2. Part 2; and
3. State law.

The interplay among these bodies of law can be quite complex with respect to the firearm prohibition. The analysis often changes on a case-by-case basis. Therefore, facilities should have health law counsel apply individual circumstances to HIPAA, Part 2 or state laws in light of the particular fact pattern at issue.

The objective is to avoid liability for prohibited disclosures even where they may appear permissible, but to also cooperate when necessary or advantageous. A PHI disclosure violation can be costly in time, penalties, lawsuits, aggravation and reputation.

As states, for instance, have become more aggressive in their efforts to obtain PHI, conservatism is advised when dealing with guns, drugs and HIPAA.

Craig D. Bronsnick is an attorney with the law firm Brach Eichler, LLC, providing health provider clients with full services for regulatory, transactional, litigation and criminal defense needs. Bronsnick also provides regulatory counsel on privacy and security laws to behavioral health and substance abuse treatment facilities across the country.