Healthcare Information Security

HIPAA and Compliance News

HIPAA Privacy Rule Changes Proposed for Background Checks

"This rule applies only to a small subset of HIPAA covered entities...and it allows such entities to report only limited identifying, non-clinical information to the NICS."

By Elizabeth Snell

The Department of Health and Human Services (HHS) announced potential modifications to the HIPAA Privacy Rule in an effort to improve the background check process individuals go through in order to purchase a firearm.  

Potential HIPAA Privacy Rule changes could affect the firearm background check process

Under the changes, certain covered entities would be allowed to disclose information to the National Instant Criminal Background Check System (NICS). Covered entities may disclose the identities of individuals who prohibited by law from owning a firearm due to “specific mental health reasons,” according to an HHS statement.

The modification will not harm the patient-provider relationship, HHS maintained, and will “ensure that individuals are not discouraged from seeking voluntary treatment.”

This rule applies only to a small subset of HIPAA covered entities that either make the mental health determinations that disqualify individuals from having a firearm or are designated by their States to report this information to NICS – and it allows such entities to report only limited identifying, non-clinical information to the NICS.

The rule does not apply to most treating providers and does not allow reporting of diagnostic, clinical, or other mental health treatment information.

HHS added that it is important to remember that the majority of Americans with mental health conditions are not violent, and that an individual who seeks help or receives services for mental health conditions is not automatically prohibited from owning a firearm.    

“HHS continues to support efforts by the Administration to dispel negative attitudes and misconceptions relating to mental illness and to encourage individuals to seek voluntary mental health services,” the blog post stated.

The information disclosure “is restricted to limited demographic and certain other information needed for NICS purposes,” according to the proposed rule.  

“Under this final rule, only covered entities with lawful authority to make the adjudications or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes, are permitted to disclose the information needed for these purposes,” the rule states.

Moreover, it prohibits the disclosure of diagnostic or clinical information from medical records or other sources. Mental health information “beyond the indication that the individual is subject to the Federal mental health prohibitor” is also not allowed to be disclosed under the proposed rule.

States generally report criminal history information to the other relevant databases that are checked by the NICS; however, many States continue to report little if any information concerning individuals subject to the Federal mental health prohibitor (or the other Federal prohibitors) to the NICS Index. As a result, the NICS does not have access to complete information about all individuals who are subject to one or more of the Federal prohibited categories or who are prohibited from possessing or receiving firearms under State law.

A White House blog post further underlined that point, stating that “unnecessary legal barriers” that prevent states from reporting relevant information to the background check system needed to be removed.

“Although States generally report criminal history information to NICS, many continue to report little information about individuals who are prohibited by Federal law from possessing or receiving a gun for specific mental health reasons,” the blog post maintained.   

HHS also explained in its statement that the information that could potentially be disclosed will be the “minimum necessary identifying information” about those who have been “involuntarily committed to a mental institution.” Furthermore, individuals who have been deemed by a lawful entity “to be a danger to themselves or others or to lack the mental capacity to manage their own affairs,” may also have some of their information disclosed to NICS.

To view the proposed final rule, click here.


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks