• E-mail
• Print
• RSS

HIPAA Q&A: PHI and marketing, disclosure of mental health information, and revising NPPs

Briefings on HIPAA, April 29, 2016

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

HIPAA Q&A

PHI and marketing, disclosure of mental health information, and revising NPPs

by Mary D. Brandt, MBA, RHIA, CHE, CHPS

Q. Would a physician be expected to report a patient’s mental and behavioral health information to the National Instant Criminal Background Check System (NICS) or the FBI? Are there specific assurances CEs should get before they release this information?

A. No. Mental health providers are not expected to report information to the NICS or FBI. NICS checks available records on persons who may be disqualified from receiving firearms. It was developed by the FBI in 1998. Individuals are prohibited from buying a gun from a licensed dealer if a background check reveals that they have been any of the following:

• Involuntarily committed to a mental institution
• Declared incompetent by a lawful authority
• Found incompetent to stand trial or found not guilty in a criminal case by reason of insanity

These disqualifications constitute what NICS calls the federal “mental health prohibitor” for gun ownership.

Courts of law are not bound by HIPAA, so they have been free to report mental health determinations to NICS. However, some state agencies covered by HIPAA also make mental health determinations or store records on them. Many of these agencies have refrained from reporting to NICS due to concerns about violating HIPAA.

An HHS rule issued January 6 modified the HIPAA Privacy Rule to specifically allow state agencies that are also CEs to disclose limited information to NICS. Agencies cannot report diagnostic or clinical information about the individual to NICS, only that he or she is subject to the mental health prohibitor, along with basic demographic information. This reporting loophole was not extended to individual physicians, hospitals, and other healthcare professionals. The rule is available at www.gpo.gov/fdsys/pkg/FR-2016-01-06/pdf/2015-33181.pdf.

However, providers may have a duty to warn based on ethical standards, state laws, and court decisions. HIPAA permits a covered healthcare provider to warn appropriate persons if the provider believes there is a serious and imminent threat of a patient physically harming him- or herself or others. See 45 CFR 164.512(j).

HHS provides a detailed fact sheet on mental health disclosures available at www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/mhguidancepdf.pdf.

Editor’s note
Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Nicole Votta at nvotta@hcpro.com.

This is an excerpt from a member only article. To read the article in its entirety, please login or subscribe to Briefings on HIPAA.

• E-mail to a Colleague
• Print
• RSS
• Archive