Behavioral Health Considerations Applicable to Recent HIPAA Modifications

On January 6, the U.S. Department of Health and Human Services issued a Final Rule, effective February 5, modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to permit certain covered entities to disclose to the National Instant Criminal Background Check System (NICS) certain demographic information of individuals subject to the federal "mental health prohibitor."

NICS is a federal database that collects information about individuals who are the subject of a federal "prohibitor." A person subject to a federal prohibitor may not legally possess or receive firearms. There are numerous categories of prohibitors, including the mental health prohibitor, which applies to individuals who have been:

• Involuntarily committed to a mental health institution;

• Found incompetent to stand trial or not guilty by reason of insanity; or

• Determined by a court or other lawful authority to be a danger to themselves or others as a result of mental illness, incompetency, condition, or disease.

Limitations on Scope of Final Rule

The Final Rule permits disclosures to NICS only by covered entities with authority to make mental health adjudications, or that serve as repositories of data relevant to NICS reporting. The Final Rule also imposes limitations on the entities to which information may be disclosed; under the Final Rule, covered entities may disclose only to NICS or a state-designated repository that reports to NICS. In addition, the Final Rule limits the nature of the information that may be disclosed: a covered entity may only disclose a patient's name, date of birth, gender, and the applicable prohibitor code. Notably, the Final Rule does not permit the covered entity to disclose the patient's diagnosis and treatment history.

State-by-State Analysis

Due to the limitations on the types of covered entities that may disclose under the Final Rule, providers must determine whether they now qualify to disclose. This determination will depend on the authority granted (or not granted) to mental health providers by state law to make mental health adjudications or order involuntary commitments. In states that do not grant adjudicatory or commitment authority to mental health providers, such providers will generally not be permitted to report under the Final Rule.

Because the civil commitment statutes and rules vary widely among states, attorneys advising mental health providers and courts must carefully consider the limitations of the Final Rule as applied to the covered entity holding the protected health information. In many states, for example, providers are granted authority to detain persons who may present a danger to themselves or others, and to continue holding such individuals for a specified number of days on the grounds that probable cause exists to justify such detention. During this time, psychiatric personnel may complete a full mental health evaluation, the findings of which are presented at a hearing to determine if involuntary commitment is medically necessary. In a significant number of states, however, mental health providers are not considered to have actual adjudicatory authority to impose involuntary commitments. In these states, the Final Rule would not permit providers to disclose information to NICS. Further, the language of the Final Rule specifies that it does not apply to "those individuals in a psychiatric facility for observation," so a provider must analyze whether an initial involuntary hold is in fact a "commitment" under state law, or alternatively, whether such a hold is considered to be merely "observation."

Some states also may allow or encourage the process of "stipulating," whereby a patient placed on an initial involuntary hold, pending further evaluation and a final hearing, stipulates to the psychiatric allegations regarding the reasons for the hold, and by doing so becomes a voluntary patient. In this case, what may have begun as an involuntary hospitalization becomes a voluntary hospitalization. As such, disclosure under the Final Rule may not be permitted if the state's laws indicate that the patient who has stipulated has not been involuntarily committed, deemed incompetent, or determined to be a danger to self or others.