CMS proposed an extensive five-year, two-phase plan to overhaul Part B drug payments for physicians and hospitals in March outside of the normal OPPS rulemaking cycle that could be implemented as early as this fall.
PHI and marketing, disclosure of mental health information, and revising NPPs
by Mary D. Brandt, MBA, RHIA, CHE, CHPS
Q. Would a physician be expected to report a patient’s mental and behavioral health information to the National Instant Criminal Background Check System (NICS) or the FBI? Are there specific assurances CEs should get before they release this information?
A. No. Mental health providers are not expected to report information to the NICS or FBI. NICS checks available records on persons who may be disqualified from receiving firearms. It was developed by the FBI in 1998. Individuals are prohibited from buying a gun from a licensed dealer if a background check reveals that they have been any of the following:
Involuntarily committed to a mental institution
Declared incompetent by a lawful authority
Found incompetent to stand trial or found not guilty in a criminal case by reason of insanity
These disqualifications constitute what NICS calls the federal “mental health prohibitor” for gun ownership.
Courts of law are not bound by HIPAA, so they have been free to report mental health determinations to NICS. However, some state agencies covered by HIPAA also make mental health determinations or store records on them. Many of these agencies have refrained from reporting to NICS due to concerns about violating HIPAA.
An HHS rule issued January 6 modified the HIPAA Privacy Rule to specifically allow state agencies that are also CEs to disclose limited information to NICS. Agencies cannot report diagnostic or clinical information about the individual to NICS, only that he or she is subject to the mental health prohibitor, along with basic demographic information. This reporting loophole was not extended to individual physicians, hospitals, and other healthcare professionals. The rule is available at www.gpo.gov/fdsys/pkg/FR-2016-01-06/pdf/2015-33181.pdf.
However, providers may have a duty to warn based on ethical standards, state laws, and court decisions. HIPAA permits a covered healthcare provider to warn appropriate persons if the provider believes there is a serious and imminent threat of a patient physically harming him- or herself or others. See 45 CFR 164.512(j).
Editor’s note Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Associate Editor Nicole Votta at nvotta@hcpro.com.
