Changes to HIPAA Privacy Rule May Help Distinguish Mental Illness from Violence

By: Paul Gionfriddo, President and CEO

This week, the President announced a number of initiatives aimed at reducing violence in America.  Two of them specifically touched on mental health/mental illness.  The first was an announcement that the Administration was proposing the expenditure of $500 million for mental health services.  There were no details about how those dollars might be spent and so we will address that later.  The second was an announcement about changes to HIPAA that would permit HIPAA-covered entities to report information to the FBI firearms registry database.   

The Administration’s changes to the HIPAA privacy rule reflect an effort to balance a number of competing interests – those who favor gun control, those who want to protect second amendment rights, those who provide diagnostic and treatment services to people with mental health concerns, and people who have mental illnesses.

It makes no changes to the HIPAA law or Brady Act, but it clarifies and limits the information that can be reported to the FBI’s National Instant Criminal Background Check System (NICS).

Since 1993, when the Brady Act was passed, (and really since 1968 when the Gun Control Act was passed) it has been illegal for the following to own or possess firearms:  “individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease.” (45 CFR Part 164, 1/4/16)

The NICS was intended to include the names of all of those individuals who could not possess firearms legally.  This presents no problem for judicial system reporters.  They add the information to their state repository, which in turn is supposed to report it to the NICS. 

However, in some states, the repository is housed in a HIPAA “covered entity,” – a provider covered by the HIPAA law.  And in some cases, a HIPAA-covered entity – not a court – makes the determination as to whether an individual meets the standard for inclusion in the registry and orders an involuntary commitment.

While HIPAA allows for the sharing of an individual’s protected health information (PHI) without the individual’s authorization for law enforcement purposes, it was not clear to these covered entities that they could report the names for inclusion in the NICS database without violating a patient’s privacy.

Therefore, what the rule says is this: (1) a firearms control data center housed in a HIPAA-covered entity can share limited demographic information with the national registry; and (2) a HIPAA-covered entity that is participating in a judicial proceeding to determine that a person cannot lawfully have a firearm (such as ordering an involuntary commitment) can share limited demographic  information with the registry.

The new provision does not:

• Allow for the addition sharing without authorization of diagnosis or treatment information of any kind, even for people who cannot legally possess firearms;
• Affect anyone who voluntarily seeks mental health services of any kind; i.e., even if they say they have an intent to harm themselves or others a provider cannot simply add their name to the registry – they must go through the judicial process and be found to meet one of the categories in the existing law;
• Allow for the additional sharing of information between or among covered entities or their business associates without authorization;
• Have any effect on HIPAA-covered entities that do not house the data repositories or make determinations regarding involuntary treatment or legal competency;
• Add anyone new to the list of people who are not legally able to possess firearms.

This change will affect a relatively small number of people (maybe in the hundreds, maybe in the thousands). So why does it matter?

It has already been determined that it is illegal for the individuals whose names will be added to the list to own or possess firearms.  So this might prevent a tragic event without infringing on the rights of anyone who can possess firearms.

More importantly from the perspective of those of us who advocate daily on behalf of individuals with mental health conditions, this might also help to draw a greater distinction in the minds of the public between those who have mental illnesses and those who are violent. The following diagram will help to explain why:

People with violent tendencies and even people with serious mental illnesses are two distinctly different groups of people.  In some instances, they overlap, but most often they do not.  Those who think that a diagnosis of mental illness should be a reason to deny firearms possession are off-track.

Millions of people have mental illnesses and not a violent thought or idea.  Millions of other people have violent thoughts and not a mental illness. 

The HIPAA change implicitly acknowledges this, and this is very important to those of us who are advocates.

It is our hope that people who embrace the change will do so not only for its carefully crafted limitations on the sharing of additional information and because it will add to the national registry some more people for whom it is already illegal to possess firearms, but also because its helps to clarify the distinctions we must continually make between those who have mental illnesses and those who have violent tendencies.