HIPAA and NICS: Balancing Two Necessary Evils

By Dr. Timothy Wheeler, M.D.

The years 2011 and 2012 saw a rash of horrible high profile murders whose suspected perpetrators bore the striking common trait of serious mental illness.  In all cases—the Aurora, Colorado movie theater mass shootings, the Newtown, Connecticut school shootings, and the shooting of Arizona congresswoman Gabrielle Giffords—the suspects were known in advance by their families or associates to be seriously disturbed.  Aurora shooting suspect James Holmes had even seen a psychiatrist, who properly reported her concerns about his instability to police.  But in all three cases our legal system failed to prevent the multiple murders of men, women, and children and the disastrous injury of a U.S. congresswoman.

In response to the shootings President Obama in January issued a list of executive actions (incorrectly described by some in the media as executive orders) officially directed at the problem of mass shootings by madmen.  In reality many of the actions are items long on the policy wish list of gun prohibitionists, and they have little if anything to do with mass shootings.  But several of the listed actions call for the legitimate goal of trying to prevent dangerously mentally ill people from obtaining firearms.

This week the U.S. Department of Health and Human Services (HHS) is calling for public comments as part of their plan to revise federal law to improve reporting of people with the so-called “mental health prohibitor” of gun ownership.  As the HHS Proposed Rule document notes, federal law already prohibits those persons from possessing or receiving a firearm who:

1)  have been involuntarily committed to a mental institution

2)  have been found incompetent to stand trial or not guilty by reason of insanity

3)  otherwise have been determined, through a formal adjudication process, to have a severe mental condition that results in the individuals presenting a danger to themselves or others or being incapable of managing their own affairs.

Most people agree that those inclined to criminal violence should not have guns.  Violent felons and people with homicidal or suicidal delusions are the categories at whom current laws are directed.  The federal National Instant Criminal Background Check System (NICS) aims to detect both categories of prohibited persons at the point of sale prior to transfer of the firearm.  But the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) includes a privacy rule that provides severe penalties for many types of disclosure of personal health information.  In some cases this includes records of mental illness required by NICS reporting.

The HHS Proposed Rule under consideration intends to “creat[e] an express permission in the HIPAA rules for reporting the relevant information to the NICS by those HIPAA covered entities responsible for involuntary commitments or the formal adjudications that would subject individuals to the mental health prohibitor, or that are otherwise designated by the States to report to the NICS.”  The intent is to overcome obstacles to NICS reporting posed by the problematic HIPAA law.

The HIPAA privacy rule was enacted with the good intention of protecting Americans from disclosure of private information contained in their medical records.  But the threat of serious penalties for stepping outside the boundaries of the law has spread fear throughout the medical community.  Doctors, medical record administrators, and hospital officials have been systematically intimidated by the law’s threat of civil and criminal penalties.  Penalties for various categories of HIPAA violations include a $50,000 fine for each violation and imprisonment for more serious violations.  HIPAA’s vast reach includes a long list of doctors, nurses, hospital administrators, and state and local health officials.  When the law was enacted medical groups and hospitals held training classes for doctors and nurses in how to comply with the complex law.

HIPAA’s unintended but entirely predictable effect was to complicate and limit appropriate communication of medical information to parties who had a valid interest in knowing it.  Doctors and nurses began to withhold information about medical emergencies from patients’ families, who were understandably outraged at being kept in the dark.  But given a choice between a family’s complaint and criminal prosecution, busy medical professionals chose the lesser of two evils.

Mental health records are the most sensitive kind of personal health information.  The keepers of these records jealously guard them as a matter of professional obligation.  The threat posed to them by HIPAA only reinforces their tendency toward protecting it from disclosure.  But the need for proper identification of dangerously mentally ill prospective gun owners is a legitimate public concern, and the political pressure to make it a reality must result in action.  Toward that end, the HHS proposed rule to modify HIPAA is a worthy objective.

Precautions must be taken in any such modification.  No disclosure to NICS of any medical information should be allowed unless it clearly establishes a prospective gun purchaser to be prohibited as described by law.  The opportunity for administrative overreach in denying NICS approval is great, given the tendency of some executive branch officials to deny gun ownership to as many people as possible.

According to the National Institute of Mental Health tens of millions of Americans suffer from mental illness each year, although many go without treatment.  Therefore mental health records in particular should be carefully secured against political attempts to stigmatize and disqualify a prospective gun owner with a psychiatric diagnosis that does not constitute a mental health prohibitor.

When possible, administrative remedies should be written into the rules to allow recovery of legal fees and other costs for persons whose constitutional right to own a firearm is infringed as a result of bureaucratic mistakes or undue delay.

All of this ignores the reality that any determined individual can obtain a firearm and use it to commit a crime, NICS and HIPAA and every other law notwithstanding.  But within the confines of imperfect law, it is reasonable to strive for amending HIPAA’s privacy requirements to allow the communication of mental health information to NICS when it establishes a prospective gun purchaser to be prohibited as described by law.

Timothy Wheeler, MD is director of Doctors for Responsible Gun Ownership, a project of the Second Amendment Foundation.

Oct 21, 2021 9:30 PM ET