The Military Command Exception to the Health Insurance Portability and Accountability Act
By Capt. Kayli Ragsdale, Fort Bliss Legal Assistance Office
The Health Insurance Portability and Accountability Act is a federal law that requires national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. HIPAA permits protected health information of service members to be disclosed under special circumstances. Under the Military Command Exception, a healthcare provider may disclose the PHI of service members for authorized activities to appropriate military command authorities. An appropriate military command authority includes commanders who exercise authority over the service member, or another person designated by a commander. The exception does not require healthcare providers to disclose PHI to commanders. It only permits the disclosure. If the disclosure is made, then only the minimum amount of information necessary should be provided. Furthermore, the exception does not permit a commander’s direct access to a service member’s electronic medical record, unless otherwise authorized by the service member or the HIPAA Privacy Rule.
Authorized activities for which PHI may be disclosed to a commander include but are not limited to fitness for duty determinations, fitness to perform a particular assignment, or the service member’s ability to carry out any other activity essential for the military mission. Once PHI has been disclosed to military command authorities, it is no longer subject to HIPAA. However, it remains protected under the Privacy Act of 1974.
To dispel stigma around service members seeking mental health care or voluntary substance misuse education, Department of Defense Instruction 6490.08 was issued to balance patient confidentiality rights with the commander’s need to make informed operational and risk management decisions. DoD healthcare providers are not permitted to notify a service member’s commander when the member obtains these services unless certain conditions are met. However, if one of the below conditions or circumstances apply, the healthcare provider is required to notify the commander:
- Harm to self. The provider believes there is a serious risk of self-harm by the service member either as a result of the condition itself or medical treatment of the condition.
- Harm to others. The provider believes there is a serious risk of harm to others either as a result of the condition itself or medical treatment of the condition. This includes any disclosure concerning child abuse or domestic violence.
- Harm to mission. The provider believes there is a serious risk of harm to a specific military operational mission. Such serious risk may include disorders that significantly impact impulsivity, insight, reliability, and judgment.
- Special personnel. The service member is in the Personnel Reliability Program or is in a position that has been pre-identified by Service regulation or the command as having mission responsibilities of such potential sensitivity or urgency that normal notification standards would significantly risk mission accomplishment.
- Inpatient care. The service member is admitted or discharged from any inpatient mental health or substance abuse treatment facility, as these are considered critical points in treatment and support nationally recognized patient safety standards.
- Acute medical conditions interfering with duty. The service member is experiencing an acute mental health condition or is engaged in an acute medical treatment regimen that impairs the service member’s ability to perform assigned duties.
- Substance misuse treatment program. The service member has entered into, or is being discharged from, a formal outpatient or inpatient treatment program for the treatment of substance abuse or dependence.
- Command-directed mental health evaluation. The mental health services are obtained as a result of a command-directed mental health evaluation.
- Other special circumstances. The notification is based on other special circumstances in which proper execution of the military mission outweighs the interests served by avoiding notification, as determined on a case-by-case basis by a health care provider.
In making a disclosure pursuant to the circumstances described above, healthcare providers shall provide the minimum amount of information to satisfy the purpose of the disclosure. In general, this shall consist of: (1) the diagnosis; a description of the treatment prescribed or planned; impact on duty or mission; recommended duty restrictions; the prognosis; any applicable duty limitations; and implications for the safety of self or others; and (2) ways the command can support or assist the service member’s treatment.
Commanders must protect the privacy of information provided pursuant to the Privacy Act. Information provided shall be restricted to personnel with a specific need to know; that is, access to the information must be necessary for the conduct of official duties. Such personnel shall also be accountable for protecting the information. Commanders must also reduce stigma through positive regard for those who seek mental health assistance to restore and maintain their mission readiness, just as they would view someone seeking treatment for any other medical issue.
If you have more questions about this topic, please schedule an appointment to speak with an attorney at the Fort Bliss Legal Assistance Office by either calling (915) 568-7141 during office hours or emailing usarmy.bliss.hqda-otjag.mesg.bliss-legal-assistance-office@mail.mil anytime.