Physician Practice

Q&A: You've got questions! We've got answers!

Physician Practice Insider, May 3, 2016

Submit your questions to Associate Editor Nicole Votta at and we will work with our experts to provide you with the information you need.

Q. Would a physician be expected to report a patient’s mental and behavioral health information to the National Instant Criminal Background Check System (NICS) or the FBI? Are there specific assurances CEs should get before they release this information?

A. No. Mental health providers are not expected to report information to the NICS or FBI. NICS checks available records on persons who may be disqualified from receiving firearms. It was developed by the FBI in 1998. Individuals are prohibited from buying a gun from a licensed dealer if a background check reveals that they have been any of the following:

  • Involuntarily committed to a mental institution
  • Declared incompetent by a lawful authority
  • Found incompetent to stand trial or found not guilty in a criminal case by reason of insanity

These disqualifications constitute what NICS calls the federal “mental health prohibitor” for gun ownership.

Courts of law are not bound by HIPAA, so they have been free to report mental health determinations to NICS. However, some state agencies covered by HIPAA also make mental health determinations or store records on them. Many of these agencies have refrained from reporting to NICS due to concerns about violating HIPAA.

An HHS rule issued January 6 modified the HIPAA Privacy Rule to specifically allow state agencies that are also CEs to disclose limited information to NICS. Agencies cannot report diagnostic or clinical information about the individual to NICS, only that he or she is subject to the mental health prohibitor, along with basic demographic information. This reporting loophole was not extended to individual physicians, hospitals, and other healthcare professionals. The rule is available at

However, providers may have a duty to warn based on ethical standards, state laws, and court decisions. HIPAA permits a covered healthcare provider to warn appropriate persons if the provider believes there is a serious and imminent threat of a patient physically harming him- or herself or others. See 45 CFR 164.512(j).

HHS provides a detailed fact sheet on mental health disclosures available at

Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, answered this question for Briefings on HIPAA. This information does not constitute legal advice. Consult legal counsel for answers to specific questions.

Most Popular