Don’t blame HIPAA for failing to protect victims of violence. This is a myth, and yet we’ve heard it again from politicians in the news speaking about obstacles to preventing gun violence. It is simply not true. Health care providers may alert family members and law enforcement if an individual poses a risk to themselves or others, without authorization from the individual.

Over the past month, gunmen have killed over three dozen people in attacks at a grocery store in Buffalo, NY, a school in Uvalde, TX, a medical office in Tulsa, OK and the streets of downtown Philadelphia, PA. But this is just a slice of the gun violence picture. There have been at least 35 mass shootings in the U.S. since May 14, 2022 and a dozen of those were over the Memorial Day weekend. Gun violence today is the leading cause of death of children in the U.S., surpassing traffic accidents, since 2020.

After headline-making gun violence occurs, there is usually talk about causes and solutions, the role of mental health, of treatment and prevention, the role of guns in society, how easy they are to obtain and gun control. Opinions vary although most agree it’s complicated. But HIPAA is not an obstacle.

Privacy Rule Balances Individual Rights with Law Enforcement

Longstanding HIPAA law has always provided exceptions to the authorization requirement to protect public safety. When a provider believes that an individual poses a risk to themselves or others, they are not required to obtain the individual’s authorization to disclose this to law enforcement to prevent harm. The U.S. Department of Health and Human Services (HHS) guidance on the topic explains that a provider may make a disclosure of protected health information (PHI) without authorization:

• to a law enforcement official reasonably able to prevent or lessen a serious and imminent threat to the health or safety of an individual or the public; or
• to identify or apprehend an individual who appears to have escaped from lawful custody.

There are other several other exceptions to the authorization requirement, including:

• To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena.
• To respond to an administrative request (not a court), such as an administrative subpoena or investigative demand or other written request from a law enforcement official.
• To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person.

The full list of exceptions can be found in the guidance.

Background Checks and HIPAA

HIPAA also permits certain providers to disclose to the National Instant Criminal Background Check System (NICS) the identities of those individuals who, for mental health reasons, already are prohibited by Federal law from having a firearm. HHS issued this modification to HIPAA in 2016.

Newer Guidance is Aimed at Gun Violence Specifically

In December, 2021 HHS issued new guidance to help prevent gun violence where extreme risk is present. The guidance explains how covered health care providers may disclose PHI to support applications for “extreme risk protection orders” (ERPOs) that temporarily prevent a person in crisis, who poses a danger to themselves or others, from accessing firearms.

This new guidance supports the U.S. Department of Justice efforts to help states manage extreme risk protection orders. The DOJ published model legislation for ERPOs in June 2021, that states may use as they draft their own laws to protect the public from firearms violence.

Note this HHS guidance is not a new rule, and HIPAA wasn’t modified: HHS issued the guidance to clarify how existing HIPAA law can support the use of ERPOs.

Keep in Mind

• As in other situations where PHI is disclosed, follow the minimum necessary standard and only disclose the minimum information required for the purpose.
• State ERPO laws vary. Check your state’s laws to make sure you comply.
• Other state and federal laws may apply related to privacy, mental health or substance use disorders. Consider whether any of these might apply in your situation.

HIPAA Myth or Fact?

If you hear someone blaming HIPAA for the latest social or health crisis, think twice. HIPAA balances privacy rights with other ideals and goals, including gun violence prevention.