Latest HIPAA Final Rule

 Latest HIPAA Final Rule

Hello HIPAA Gang! Do you remember the HIPPOs everyone gave out when HIPAA was brand new? Well, Mama Hippo just gave birth to a new little Hippo, a new HIPAA Final Rule on January 6, 2015 … at least this one did not complicate the holidays of 2015.

This rule, as usual, has an elaborate name; it is Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the National Instant Criminal Background Check System (NICS) final rule. Of course, the industry already has a nickname for it – the gun check rule! It really is the FBI check on whether or not an individual who wants to purchase a firearm from a federally licensed vendor is not someone who is mentally ill.

The new HIPAA final rule is effective on February 5, 2016. This means that if your organization is a covered entity that cares for mentally ill patients, you will need to understand all the nuances of the new rule and be ready to report to the NICS if necessary.

So the nitty-gritty is as follows:

  • The HIPAA Privacy Rule is being added section 512: Uses and disclosures for which an authorization or opportunity to agree or object is not required (k) Standard: Uses and disclosures for specialized government functions, (7) National Instant Criminal Background Check System.
  • Covered entities may do or not do the following:
    • If a covered entity orders involuntary commitments or make other adjudications regarding an individual’s mental health, or that serve as repositories of the relevant data, are permitted to use or disclose the information needed for NICS reporting of such individuals either directly to the NICS or to a State repository of NICS data.
    • If a covered health care entity also has a role in the relevant mental health adjudications or serves as a State data repository, it now may disclose the relevant information for NICS reporting purposes under this new permission even if it is not designated as a HIPAA hybrid entity or required by State law to report.
    • It does not create an express permission for covered entities to disclose for NICS reporting purposes the PHI of individuals who are subject to State-only mental health prohibitors.

If you are one of the covered entities that must report to the NICS the preamble states that you must report the data elements that the NICS needs to create a record plus there more that you are permitted to share with NICS.

The data elements needed to create the NICS record are:

  • The individual’s name
  • The individual’s sex
  • The individual’s date of birth
  • The Federal mental health prohibitor[1]
  • The record documenting the involuntary commitment or adjudication, and
  • The entity from which the record initiated, in other words your business name.

The additional data elements you may send include:

  • The individual’s Social Security number
  • The individual’s State of residence
  • The individual’s height
  • The individual’s weight
  • The individual’s place of birth
  • The individual’s eye color
  • The individual’s hair color, and
  • The individual’s race.

These additional data elements will help the feds weed out false positives.

One last thought, the new section in the HIPAA Privacy rule does not name any data elements outlined above. This gives the reporting covered entity the flexibility to report the data elements required and requested by the feds and any state requirements your state may have for this area.

Your reporter, Sue Miller, has a 10-page memorandum explaining the new HIPAA final rule in depth. You may purchase it from her at or 978-505-5660.

[1] Federal mental health prohibitor makes individuals ineligible to purchase a firearm because they have been “committed to a mental institution” or “adjudicated as a mental defective.”

DOJ regulations define these categories to include persons who:

  • Have been involuntarily committed to a mental institution for reasons such as mental illness or drug use;
  • Have been found incompetent to stand trial or not guilty by reason of insanity; or
  • Otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or unable to manage their own affairs, as a result of marked subnormal intelligence, or mental illness, incompetency, condition, or disease.