Part 4: Pilot Medical Privacy

Overview: Pilot Medical Privacy

This is part 4 in our Germanwings crash series on preventing aircraft-assisted homicide. Previous sections discussed medical and psychological screening. This segment addresses the controversial rules of pilot medical privacy. Aviation Medical Examiners (AMEs) respect the principles of privacy and patient advocacy, but when acting as AMEs, their primary duty is to safeguard the skies and verify that flyers are fit to fly. The Pilot-AME encounter is a complex and unique type of doctor-patient relationship with distinct privacy rules. Evolving legal guidance is derived from statutory law, agency policy and case law including a 2011 U.S. Supreme Court decision (FAA v. Cooper).

What is Protected Medical Data?

Per the U.S. Department of Health and Human Services, protected health information (PHI) is any individually identifiable information that relates to:

Pilot Protected Health Information

Pilot PHI includes any of the above elements that are transmitted or maintained in any form (electronic, oral, or paper) by a covered entity or its associates. For flyers, PHI includes medical findings created or received by the FAA 's Aeromedical Certification Division (AMCD). It does not matter where the medical data originates. Records from any of the pilot's past health care providers including AMEs, specialists, primary care clinicians or mental health therapists are aggregated by the AME.

After assimilating the PHI from external sources (including verbal info), the AME may contemporaneously decide the outcome (pass/fail) or defer the certification decision until receiving more information or results of additional testing. Some decisions require higher authority such as the FAA Regional Flight Surgeon.

Either way, the AME ultimately forwards recommendations and supportive documentation to the FAA in support of the fly vs no-fly decision. In sum, PHI broadly encompasses any recorded or relayed data that reasonably relates to past, present, or future physical or mental diagnostic decisions or therapeutic interventions on behalf of the pilot including billing records.

Privacy - What Must Pilots Report?

During the periodic flight physical, pilots have a duty to report all visits in the last 3 years to a physician, physician assistant, nurse practitioner, psychologist, clinical social worker, or substance abuse specialist for treatment, examination, or medical/mental evaluation. The Aviation Medical Examiner (AME) reviews the written statement and interviews the pilot for further elaboration as needed.

Counseling Sessions

Counseling visits are reportable if counseling was related to substance abuse or any psychiatric condition. To deter incomplete history, the pilot must attest to whether they have any other illness, disability or surgery (Item 18.x). As deliberated and confirmed by the landmark FAA v. Cooper Supreme Court Case (detailed below), the pilot must also reveal any disability benefits at the time of the flight physical or face fraud charges (Item 18.y).

Comparison with other sources of medical records is unlikely to be legally found as a privacy breech because the pilot consents, and because flying is a privilege not a right. Conversely, fraud penalties are stiff--up to 5 years prison and/or $250,000 fine. (Source: Title 18 U.S. Code. Secs. 1001; 3571) The only optional part of the application form is the Social Security Number (SSN). If the pilot declines to answer any of the questions (except for SSN), then the AME must defer or deny issuance of the Aviation Medical Certification. Declining to provide a SSN is not grounds for refusal, a substitute locator number will be assigned.

Substance Abuse or Psychiatric Problems

Despite the threat of intimidating penalties and career consequences, troubled aviators may need confidential counseling for depression, substance abuse or other problems. Pilots have the right to be protected against unreasonable searches and seizures, so herein lies the privacy controversy. By choosing to become or remain professional airmen, pilots have forfeited some of their medical and psychiatric privacy rights.

Additional Requests for External Records

Even if the pilot apparently passes their flight physical, the records are still subject to further review. At any time, the AME or the FAA may deem that additional medical information or history is necessary. Every effort is made to avoid surprises, but if someone in the aeromedical chain of command determines more data is needed to determine:

whether an applicant for (or holder of) an aviation medical certificate meets medical standards...

In rare situations, the FAA discovers something missed and they ground the pilot even if the existing medical certificate has not expired. The FAA must promptly inform the pilot and precisely describe the limitations, timeframes and next steps. These after-the-fact notices are obviously inconvenient and unwelcome surprises for medically certified active pilots already on flight schedules.

Ideally, the need for extra info is discovered at the flight physical, and the AME explains the situation in real time. When notified in the AME office or by the FAA in the mail, the pilot signs a specific authorization for Release of Medical Information for any relevant outside facility with release to the FAA. If the pilot fails to release or otherwise provide the requested medical information, the FAA may suspend, modify, or revoke all medical certificates the airman holds.

Privacy vs Privilege

Privacy is a well known hallmark of professional medical encounters because it encourages truthfulness and improves the therapeutic alliance. Medical records and communication must be kept private and secured against unintentional disclosure. The next level of protection is called physician–patient privilege. Privilege is an expanded legal notion of a higher confidentiality.

Privilege is intended to protect communications between patient and doctor, so that the data is not legally discoverable. It is a protection design to prevent the record from being used punitively in future proceedings. When records are privileged, not only are there the normal restrictions against unauthorized public access, but the doctor is also protected and can not be compelled to testify in court or administrative hearing. Privileged records become inadmissible evidence.

Scope of Privacy Rule and Privilege

In the U.S., the federal HIPAA Privacy Rule covers all individually identifiable health information for both U.S. citizens and non-citizens seeking aviation medical certification, but surprisingly there is no overriding federal legal "privilege" applied to all national medical records. In some jurisdictions, conversations between a patient and physician are privileged in both criminal and civil courts. States have various rules on this complex topic, so case-specific protections of doctor-patient encounters depend on statutory or case law from a particular jurisdiction.

Nonrepudiation

Pilot-patients surrender some personal information control during the flight physical process even if the AME is also the patient-pilot's regular primary care physician. Unlike traditional medical records, once submitted, the pilot-applicant's online medical application (MedXPress), and all of the associated records and attachments become government property, so it is not easy to withdraw data once submitted. Neither HIPAA nor legal privilege allow for easy pilot retraction if the goals of the applicant (keep flying) and the FAA (protect public) become misaligned.

FAA Rights to Share Pilot Medical Data with other Agencies

When submitted the electronic application through MedXPress, there are numerous disclaimers and warnings. Pilots are expressly notified that the FAA has the right to disclose information as needed to:

• National Transportation Safety Board (NTSB) in connection with its investigation responsibilities;
• Provide information about airmen to Federal, state, and local law enforcement agencies when engaged in the investigation and apprehension of drug law violators;
• Provide information about enforcement actions arising out of violations of the Federal Aviation Regulations to government agencies, the aviation industry, and the public upon request;
• Disclose information to another Federal agency, or to a court or an administrative tribunal, when the Government or one of its agencies is a party to a judicial proceeding before the court or involved in administrative proceedings before the tribunal; and
• Disclose information to other Federal agencies for verification of the accuracy or completeness of the information;

Operation Safe Pilot

In 2002, agents from the Inspector General's Office devised a plan to catch pilots that were cheating the system and/or fraudulently applying for Airman Medical Certificates. In 2002, inspectors launched Operation Safe Pilot to find pilots who were fraudulently collecting disability benefits or making misstatements to their AMEs during their flight physicals.

During the operation, the FAA disclosed files on 45,000 pilots in Northern California to an Inspector General, including the pilots' names, dates of birth, and social security numbers. Investigators scanned and matched previously segregated sets of data to uncover pilots with FAA Aviation Medical Certificates who were suspiciously cleared to fly but also receiving disability benefits from the Social Security Administration (SSA).

Californian Pilot found on Disability

As a result of Operation Safe Pilot, a fraudulent Californian pilot was discovered in 2005 and his case emerged onto the headlines. Investigators found 2 inconsistent records. They discovered he never disclosed his positive HIV status or medications to the FAA although his SSA disability file mentioned the condition and antiretroviral drugs. The pilot confessed to knowingly withholding information about his medical condition and medications during his flight physical and plead guilty to fraud. He was temporarily grounded, fined $1000 and sentenced to probation for lying to a government agency and delivering a false official writing.

Interestingly, his medical and pilot certificates were later reinstated in 2008 because HIV+ status is not an absolute contraindication to flight. This landmark pilot privacy case was eventually appealed and ultimately reviewed by the U.S. Supreme Court in FAA, et al v. Cooper in 2011. The decision to restore his medical and pilot privileges was not a legal decision nor was it based on his piloting skills. The FAA decision to let him fly again was a medical one based on adequate HIV treatments, stable condition and more complete medical data. Ever since 2008, there are new parts on the medical application form adding a specific question about disability and fuller disclaimers, so FAA due diligence rights are explicitly clear.

Pilot Sues FAA for Privacy Breech

Meanwhile, the grounded Californian pilot had filed his own lawsuit accusing the government of "willful or intentional" violations of his Privacy rights under the Privacy Act because two government agencies improperly compared his medical files without consent or director approval. He alleged this caused him "to suffer humiliation, embarrassment, mental anguish, fear of social ostracism, and other severe emotional distress."

Legal Outcome of Pilot Privacy Case

This high profile case offers lessons about the complexity of pilot medical privacy. Neither the government nor the pilot emerged blameless. The government acknowledged that they violated the pilot's medical privacy rights by comparing his medical files without consent or director approval.

The Supreme Court disagreed with the Appeals Court, saying that "Waiver of sovereign immunity must be 'unequivocally expressed" in the law. Impact on pilot medical protection vs the public's need to know are unclear but The Supreme Court opined in a split decision that the Privacy Act does not unequivocally authorize an award of damages for mental or emotional distress, so the Privacy Act does not waive the Federal Government's sovereign immunity from the liability.

How Strictly Protected are Pilot Health Records?

There are many exceptions to patient confidentiality, and the authorized disclosure of personal health information (PHI) without consent of the patient. Disclosure allowances are made for military, national defense and security and other special government functions, or for Public Health reasons to avert a serious threat to the health and safety of a person or the public at large.

HIPAA law basically gives pilots (as patients) the right to access a copy or inspect their PHI, amend it and request an accounting of disclosures. Pilots have the right to complain to the Secretary of the United States Department of Health and Human Services for suspected privacy violations without retaliation.

After the epic Supreme Court case, the FAA changed the notice on the Form 8500-8 Medical certificate Application, so that pilots affirmatively acknowledge that the FAA will, as needed, compare data with other agencies that might be providing disability benefits to the individual. In sum, applicants explicitly give the FAA permission to share data as needed.

Next WayPoint - Duty to Report Suspicions

This segment discussed pilot medical privacy and the series continues with the next segment, Part 5: Doctor's Duty to Warn... →