HIPAA Compliance Requirements for Aviation Medical Examiner Practices

When does HIPAA apply to an aviation medical examiner practice?

An Aviation Medical Examiner (AME) practice is not automatically a HIPAA covered entity just because it performs FAA medical examinations or handles health information. HIPAA generally covers health care providers when they electronically transmit health information in connection with an electronic standard transaction for which HHS has adopted a standard—for example, certain insurance claims or eligibility inquiries. The rule can apply when the practice submits transactions itself or uses a billing service or other intermediary to submit them on its behalf. See HHS guidance on who must comply with HIPAA.

FAA designation alone does not determine whether the AME’s practice is covered. The FAA’s AME Guide says HIPAA requirements may depend on an examiner’s activities and practice patterns. An AME should therefore assess the practice’s billing and electronic transactions separately from its FAA duties. Even if HIPAA does not apply to a particular practice, the AME may still have confidentiality duties under FAA guidance, state law, professional obligations, or other applicable rules. See the FAA guidance on privacy of medical information.

If the practice is covered, HIPAA protections apply to protected health information (PHI) the practice creates, receives, maintains, or transmits in its covered role. The scope is not limited to information sent to an insurer; it can include medical records and other individually identifiable health information held by the practice.

How do electronic transactions affect HIPAA-covered status?

The key question is not simply whether an AME uses computers, email, or an online portal. HIPAA covered status turns on whether a health care provider transmits information electronically in connection with a transaction for which HHS has adopted a standard. Sending an email or storing records electronically, by itself, does not make a provider a covered entity. HHS describes covered providers and applicable transactions in its overview of covered entities and list of adopted standards and operating rules.

By contrast, a practice that electronically submits standardized health-plan claims or other covered transactions may meet the provider definition, including when a clearinghouse or billing company submits them for the practice. Review the practice’s actual workflows and contracts rather than relying on whether the AME personally presses “submit.”

The FAA’s medical-certification workflow is distinct from those listed HIPAA transactions. FAA materials describe MedXPress and the Aerospace Medical Certification Subsystem (AMCS) as systems for submitting and transmitting FAA medical application information. Using those systems, or receiving FAA medical examination reports, does not by itself establish that the practice conducts a HIPAA standard transaction. See the FAA description of AMCS and the AME Guide’s application review instructions.

What privacy protections apply to FAA examination information?

For an AME practice that is a HIPAA covered entity, the Privacy Rule generally governs how the practice uses and discloses PHI. It requires safeguards for PHI and limits its use or disclosure to circumstances allowed or required by the Rule. When the minimum necessary standard applies, the practice should limit the information disclosed to what is reasonably needed for the purpose. HHS summarizes these protections in its Summary of the HIPAA Privacy Rule.

FAA medical-certification information also has a distinct federal privacy framework. The FAA says Privacy Act safeguards apply to medical-certification applications and other medical files in FAA possession, and instructs an AME acting as an FAA representative to handle applicant information in accordance with those requirements. That does not mean the Privacy Act automatically governs every record in a private AME office; the applicable protections depend on who maintains the record and in what capacity. See the FAA AME Guide privacy instructions.

Keep access limited to staff who need the information for their work, verify recipients before sending records, and use secure methods appropriate to the sensitivity of the information. Separate FAA application material from other clinical records where practical, and apply the rules relevant to each record rather than assuming all information follows the same legal framework.

When is written authorization required to disclose applicant records?

If a practice is covered by HIPAA, it generally needs a valid HIPAA authorization before disclosing PHI for a purpose that the Privacy Rule does not otherwise permit or require. Examples may include sending an applicant’s FAA medical examination reports to an employer, life insurer, or other third party for a purpose unrelated to treatment, payment, or health care operations. The requestor’s interest in the information is not, by itself, permission to release it.

A HIPAA authorization must identify the information to be disclosed, the person or entity authorized to disclose it, the recipient, an expiration date or event, and other required statements. A general verbal consent is not a substitute where the Privacy Rule requires an authorization. See HHS guidance distinguishing consent from authorization.

Do not treat an applicant’s FAA application or acknowledgment of the FAA Privacy Act statement as blanket permission to release records to unrelated recipients. The FAA explains that information entered into MedXPress is transmitted to the FAA and made available to the applicant’s AME for the examination; that process is separate from an authorization for a later disclosure to someone else. See the FAA MedXPress User Guide.

Which HIPAA exceptions permit disclosure without authorization?

HIPAA permits certain disclosures without an individual’s authorization, but an AME should identify the specific rule that applies rather than assume a request qualifies. Common categories include disclosures for treatment, payment, and health care operations; disclosures to the individual; and disclosures required or permitted for specified public-interest purposes. The details and limits vary by category. See HHS’s summary of permitted uses and disclosures.

A disclosure required by law is limited to what the law requires. A court order may permit disclosure of the PHI expressly authorized by the order. A subpoena without a court order is different: HIPAA may allow disclosure only when the applicable conditions are met, such as receiving satisfactory assurances that the individual was notified or that efforts were made to obtain a qualified protective order. See HHS guidance on court orders and subpoenas.

Other exceptions—such as certain public health or health oversight disclosures—apply only when the recipient, purpose, and circumstances satisfy the relevant rule. An FAA request is not automatically a HIPAA exception merely because it comes from a federal agency. For an FAA-specific request or legal process, follow FAA guidance and separately confirm the basis for disclosure under any HIPAA rules that apply to the practice.

How should AMEs handle FAA requests and retain released records?

Use FAA systems and procedures for the medical-certification information the AME is required to submit as part of the examination. The FAA Guide states that the completed FAA Form 8500-8 is electronically transmitted to the FAA, and AMCS is the system used to transmit flight-physical information. See the FAA application review instructions and AMCS information.

Handle requests for copies or other releases separately from routine FAA submission. The FAA instructs AMEs to contact the appropriate Regional Flight Surgeon or the Aerospace Medical Certification Division when a court order or subpoena is received. It also advises seeking FAA guidance before releasing information when written applicant consent is not routine, and says copies of released information should be retained. See the FAA privacy guidance for AMEs.

For useful disclosure documentation, record what was released, to whom, when, how, and under what authorization or other legal basis. Retain the authorization or legal process, any required notices or assurances, and a copy of the material released in accordance with applicable FAA instructions and the practice’s record-retention policies. For HIPAA-covered practices, also apply the Privacy Rule’s minimum necessary standard when it applies and consider state law or other restrictions that may be more protective.

What privacy and confidentiality rights do applicants have?

When an AME practice is a HIPAA covered entity, an applicant generally has a right to access PHI about them in the practice’s designated record set, subject to limited exceptions. This may include medical records and other records used to make decisions about the individual. Applicants may also have the right to request an amendment and, in circumstances covered by the Rule, an accounting of certain disclosures. See HHS guidance on the right to access health information.

HIPAA access rights apply to records maintained by or for a covered entity; they are distinct from requests for records held by the FAA. The FAA’s Privacy Act protections apply to medical-certification information in FAA files, while records maintained by an AME practice are handled under the laws and duties applicable to that practice. Applicants should direct requests to the organization that maintains the records and specify whether they seek practice records or FAA-held records.

In short, an AME should determine covered-entity status from the practice’s electronic standard transactions, protect applicant information under every applicable privacy framework, and verify the legal basis and scope before making a separate disclosure.

FAQs.

Are all aviation medical examiners subject to HIPAA?

No. An AME is not automatically a HIPAA covered entity because of FAA designation or because the examiner handles medical information. A health care provider generally becomes covered when it transmits health information electronically in connection with an HHS-adopted standard transaction. FAA confidentiality and Privacy Act-related duties may still apply to an AME’s FAA role.

Can an AME release an FAA examination report to someone other than the applicant or FAA?

Not automatically. If the practice is HIPAA-covered, the AME generally needs a valid HIPAA authorization unless a specific permitted or required disclosure applies. FAA guidance also says information should not be released without the applicant’s written consent or a court order, and recommends contacting the FAA about court orders or subpoenas. Other applicable laws may impose additional limits.

When may an AME disclose medical information without written authorization?

Depending on the facts and the rules that apply, HIPAA may permit or require disclosures for treatment, payment, health care operations, disclosures required by law, certain court or subpoena processes, and other defined public-interest purposes. Each exception has conditions and limits. An AME should verify the specific basis before releasing information; an agency request alone does not establish that an exception applies.

Should an AME contact the FAA before releasing examination information?

Yes, for court orders or subpoenas, FAA guidance directs the AME to contact the appropriate Regional Flight Surgeon or the Aerospace Medical Certification Division. For other releases, follow the FAA Guide, confirm any required applicant authorization, and determine whether HIPAA or another law applies to the practice and the records.