The Department of Health and Human Services Office for Civil Rights (OCR) recently announced via an Advance Notice of Proposed Rulemaking (ANPRM) that it is considering amending the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule. The proposed amendment would expressly permit covered entities holding information about the identities of individuals who are prohibited under federal law from owning firearms to disclose limited information to the National Instant Criminal Background Check System (“NICS”) database. OCR is also soliciting comments from the public to better understand any problems the HIPAA Privacy Rule may pose to reporting to NICS the identities of persons who may be prohibited by law from possessing a firearm due to mental health issues and how these problems may be corrected. Existing federal gun control laws identify several categories of individuals who are prohibited from receiving or possessing firearms (“prohibitors”). The mental health prohibitor applies to individuals who have been (1) involuntarily committed to a mental institution; (2) found incompetent to stand trial or not guilty by reason of insanity; or (3) otherwise adjudicated as having a serious mental condition that results in the individuals presenting a danger to themselves or others or being unable to manage their own affairs. Federal law does not require State agencies to report to NICS the identities of individuals who are prohibited from purchasing firearms, and according to OCR, many States do not report complete information to the NICS, making the database incomplete. Currently, the only information reported to the NICS is demographic information about the individual (name, date of birth, Social Security number) and the fact that the individual is subject to the mental health prohibitor. The individual’s underlying diagnosis, treatment records, and other identifiable health information is not provided to or maintained by NICS. When a federal firearm licensee queries the NICS database to see if he or she may complete the sale of a gun, he or she is told only that the transaction is denied and not if it is denied due to a mental health prohibitor. OCR Director Leon Rodriguez said in the press release accompanying the publication of the ANPRM that the NICS is not a mental health registry and that the proposed rulemaking will not create such a registry. In the ANPRM, OCR states that, when crafting the elements of an express permission allowing covered entities to disclose the identity of persons subject to a mental health prohibitor, it will consider limiting the information to the minimum amount necessary. Such information potentially would include the name of the individual subject to the mental health prohibitor, demographic information about the person such as his or her date of birth, and codes identifying the reporting entity and the relevant prohibitor. OCR will not consider allowing disclosure of an individual’s treatment record or any other clinical or diagnostic information. The agency would consider allowing disclosures for NICS purposes only by those covered entities that order involuntary commitments, perform relevant mental health adjudications, or are otherwise designated as State repositories for NICS reporting purposes. OCR notes that many records related to adjudications of incompetency to stand trial and civil commitments originate in the courts or criminal justice system agencies, which are not covered entities subject to HIPAA, and therefore can be reported by those State agencies without violating the Privacy Rule. OCR also suggests that State agencies that perform both health care services and non-health care services (which would include NICS reporting), may become “hybrid entities” under HIPAA, with the Privacy Rule restrictions applying only to the portion of the entity providing health care services. OCR poses fifteen questions, not including subparts, for commenters to address to assist the agency in better understanding the current barriers for reporting to NICS. Questions include whether the commenter’s state routinely reports the identities of individuals who are subject to the Federal mental health prohibitor to the NICS; if a State does not routinely report such information, what are the reasons for not reporting; and is the HIPAA Privacy Rule perceived as a barrier to reporting. Several questions relate to whether a reporting requirement may adversely affect people seeking needed mental health services and how HHS could mitigate any unintended consequences so that people are not discouraged from seeking mental health services if the Privacy Rule is revised to permit more robust reporting to the NICS. Comments are due to OCR by June 7, 2013 and may be submitted electronically.