By Siranya Rhuvattana

After the mass shootings in Colorado and Connecticut, President Barack Obama has attempted to curb the gun violence by, among other ways, improving the Federal government’s background check system for the sale or transfer of firearms by licensed dealers, called the National Instant Criminal Background Check System (NICS). The Department of Health and Human Services (HHS) is accordingly considering amending the Health Insurance Portability and Accountability Act (HIPAA) privacy rule to allow covered entities to disclose the identities of those deemed dangerous. (link: Link:


NICS Index

The NICS Index is a database administered by the Federal Bureau of Investigation (FBI) established to collect and keep certain identifying information about individuals who are subject to one or more of the Federal prohibitors and thus, are ineligible to purchase firearms. In general, the Federal Firearms Licensees are required to request a background check through the NICS before selling guns to a buyer. The mental health prohibitors include those who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined, through a formal adjudication process, to have a severe mental condition that results in the individuals presenting a danger to themselves or others or being incapable of managing their own affairs.

The demographic information about the individual maintained in the NICS database is restricted to only the names of ineligible individuals and certain other identifying information, such as their dates of birth, and codes for the submitting entity and the prohibited category that applies to the individual. The underlying diagnoses, treatment records, and other identifiable health information is not provided to or maintained by the NICS. However, State agencies are not required to report to the NICS the identities of individuals who are prohibited from purchasing firearms. The NICS Index, thus, could not encompass the information of all mental health prohibitors.


HIPAA implications

Where the record of an involuntary commitment or mental health adjudication

originated with a HIPAA covered entity, or the HIPAA covered entity is the State

repository for such records, the records are subject to HIPAA. Nonetheless, due to the variety of State laws, there may be other parties such as State agencies, boards, commissions, or other lawful authorities outside the court system that are involved and to what extent these parties that order involuntary commitments or conduct mental health adjudications are HIPAA covered entities. Also, there may be some designated repositories by State laws that needs to be determined as to whether they are subject to HIPAA, such as State health agencies, to collect and report to the NICS the identities of individuals subject to the mental health prohibitor. Although HIPAA allows the State agency to designate itself a hybrid entity by labeling its health care components as separate from other components and documenting that designation, there may be administrative or other challenges to the creation of a hybrid entity.

As a result of unclear extent of covered entities and their obligations, many States still are not reporting essential mental health prohibitor information to the NICS. Some States may face practical difficulties in passing a State law requiring NICS disclosures, but primary concern is about the HIPAA Privacy Rule’s restrictions on covered entities’ disclosures of protected health information which may prevent certain them from reporting to the NICS the identities of individuals who are subject to the mental health prohibitor. (link:

In addition, the provided names will then be cross-checked against a state database of people who have registered their weapons. Law enforcement officials would then have the option of removing weapons from that individual, and suspending or revoking any gun permits they hold. Harvey Rosenthal, an executive director for the state Association of Psychiatric Rehabilitation Services (link: was of concern that a danger that the information might fall into the wrong hands, or prejudice police or other authorities who come in contact with someone over a non-gun-related issue.

Thus, the HHS’s advance notice of proposed rulemaking (link: is seeking public comment on how HIPAA is preventing states from sharing such records, and how the law would be in place without discouraging individuals from reaching out for medical cares. Wide public recommendations would, expectantly, provide a balanced strike between the privacy interest and public security.