ILI Student Blog

Information Law, Policy and Digital Privacy

HIPAA, Gun Control, and Mental Health

By Ashley Jacques

HIPAA, Gun Control, and Mental Health

By: Erika Asgeirsson

A new HIPAA rule issued in January will allow certain health agencies and medical facilities (“covered entities” under HIPAA) to report the identity of individuals subject to mental health disqualifications to the federal database to prevent them from purchasing firearms. 45 C.F.R. § 164.512(k)(7). Currently those involuntarily committed to mental health institutions, those found incompetent to stand trial, and those deemed a danger to themselves or others are excluded from shipping, transporting, possessing, or receiving a firearm. In the past, certain covered entities often did not disclose the identity of these individuals to the federal database for fear of violating HIPAA. The new rule, which the administration asserts only clarifies and does not change the situation, is part of President Obama’s action more generally on gun control.

As the Washington Post article notes, mental health advocates are spilt on this rule. While encouraged by increased attention to the need to effectively care for those suffering from a mental illness, some advocates argue this rule unfairly targets the mentally ill, stigmatizes those suffering from a mental illness, and is not based on data about gun violence actually committed by this community.

Analyzing this rule from a privacy perspective shows that this issue is much more complicated than it often appears. I agree that we need to take action to reduce gun violence. Attention to mental illness and its intersection with gun violence has recently become a common talking point. However, there are compelling interests on both sides that should make even those supportive of gun control think more critically about this rule. Such restrictions have the potential to reduce gun violence by ensuring that firearms do not fall into the hands of those who should not have them. On the other hand, the attitudes underlying this rule stigmatize those suffering from mental illness. The rule might discourage people from seeking needed treatment or unduly target those suffering from a mental illness without supporting evidence. Important privacy interests are at stake because HIPAA deals with very sensitive information that is often relayed through a health care provider, who has a protected relationship with the patient. (Note, the final rule does not apply to most health care providers but applies to entities the provider may report to.)

Given this context, it is important to think deeply about this rule and its subsequent implementation. While the points below remain preliminary suggestions, I hope they might encourage further conversation on this important issue. None of these are easy to solve, and will take a great deal of time and effort. However, they are a starting point to ensure that the competing interests, including privacy, are properly balanced.  Some of these appear to be addressed in the administration rule, while others may require more action.

  1. Keep the circle close. Ensure the information is only shared with the database and not with other related agencies. The new rule explicitly addresses who the covered entity discloses information to (the database or a designated entity per 45 C.F.R. 164.512(k)(7)), but it is also important to address who the federal database shares information with and what information is shared. Given the sensitive nature of the information, it may require more rigorous requirements regarding the extent of disclosure by the database than those imposed for the disclosure of other information in the federal database.
  2. Disclose as little as possible. Under the rule, the entity only discloses certain demographic and other data, and does not include the specific diagnosis or other clinical information. The extent of information disclosed to the database should be consistently reassessed to ensure only the information necessary is disclosed.
  3. Use an evidence-based approach. Thresholds triggering the prohibition should be based on clear supporting data so that those suffering from a mental illness are not unnecessarily targeted. In addition to ensuring fair treatment, this also protects against overbroad disclose and other infringements on privacy.
  4. Right to appeal. Just as it is important that a consumer has the opportunity to correct data collected on her, the information and determination must be subject to appeal. This includes appealing misidentification or incorrect classification. Procedures for appeal need to respect the privacy and dignity of the individual contesting the identification or determination.
  5. Explore alternatives that are less intrusive to patient privacy. Other actions, such as increased funding for mental health treatment or gun training and licensing requirements, may be just as or more effective at reducing gun violence with a more limited intrusion into the patient privacy. More research should be done to better evaluate the efficacy of various alternatives.
  6. Operate on principles that protect the dignity of those suffering from mental illness. Ensure that the rules and implementation do not stigmatize those suffering from mental illness. Privacy is often a central element to human dignity.

Sources:

For further information, please see: