Covered entities evaluating the impact of this HIPAA amendment should take note that the use or disclosure authorized by this amendment is PERMISSIVE, not mandatory. The language of the rule states the covered entity “may” use or disclose PHI for purposes of reporting to the NICS the identity of an individual who is prohibited from possessing a firearm under 18 USC 922(g)(4). The covered entity is not required to do so. Therefore, if a covered entity isn’t sure whether they are allowed by this recent amendment to make a disclosure to the NICS, the normal compliance strategy would require careful consideration.
It’s important to understand the narrow category of individuals prohibited from possessing a firearm under 18 USC 922(g)(4). Individuals are prohibited from possessing a firearm under that statute only if they have been “adjudicated as a mental defective” or have been “committed to a mental institution”. As defined in 27 CFR 478.11, both the adjudication and commitment require action or determination by a “court, board, commission, or other lawful authority.” Under Louisiana law, the commitment of an individual to a mental institution pursuant to a physician emergency certificate (PEC) is not sufficient to authorize a covered entity to use or disclosure of PHI under this HIPAA amendment. As explained in United States v. Giardina, 861 F.2d 1334, 1336 (5th Cir. 1988), “[a] review of Louisiana’s admission by emergency certificate procedure reflects its magnitude, but it also clearly reflects that this procedure does not constitute a commitment under Louisiana law.” The court went on to conclude that because there was no judicial commitment, there was no violation of 18 USC 922.
Written by: Jacob Simpson