Skip Navigation

HIPAA Privacy Rule and the National Instant Criminal Background Check System (NICS)

As part of President Obama’s continuing efforts to reduce gun violence, HHS published a Notice of Proposed Rulemaking (NPRM) on January 7, 2014, to remove unnecessary legal barriers under the HIPAA Privacy Rule that may prevent states from reporting certain information to the National Instant Criminal Background Check System (NICS). The NICS helps to ensure that guns are not sold to those prohibited by law from having them, including felons, those convicted of domestic violence, and individuals involuntarily committed to a mental institution. However, the background check system is only as effective as the information that is available to it.

On April 23, 2013, the Department published an Advance Notice of Proposed Rulemaking (ANPRM) requesting the public’s input on how HIPAA may affect some states’ ability to report to the NICS and ways in which these barriers could be addressed without discouraging individuals from seeking mental health services.  Over 2,000 comments were received from individuals, state agencies, health care providers, professional organizations, consumer advocacy groups, and other stakeholders.  After considering the public comments received, the Department developed a NPRM, which proposes to modify the HIPAA Privacy Rule to permit certain HIPAA-covered entities to disclose to the NICS the identities of persons prohibited by federal law from possessing or receiving a firearm for reasons related to mental health.

The proposal would give states and certain covered entities added flexibility to ensure accurate but limited information is reported to the NICS, which would not include clinical, diagnostic, or other mental health information.  Instead, certain covered entities would be permitted to disclose the minimum necessary identifying information about individuals who have been involuntarily committed to a mental institution or otherwise have been determined by a lawful authority to be a danger to themselves or others or to lack the mental capacity to manage their own affairs.  Importantly, the proposed permission focuses on those entities performing relevant commitments, adjudications, or data repository functions.  The proposed modifications would merely permit, and not require, covered entities to report to the NICS.  In addition, the proposed rule would not change the existing permitted uses and disclosures of protected health information under the HIPAA Privacy Rule.

The NPRM is available for review at: http://www.federalregister.gov.  Comments can be submitted to http://www.regulations.gov.