HIPAA Military Command Exception

The Health Insurance Portability and Accountability Act (HIPAA) permits protected health information (PHI) of Armed Forces personnel to be disclosed under special circumstances. Under the Military Command Exception to the HIPAA Privacy Rule, covered entities may use and disclose personal health information of Armed Forces personnel, if such use and disclosure is deemed necessary by appropriate military command authorities to assure the proper execution of a military mission. This HIPAA Military Command Exception permits the use and disclosure of PHI that would otherwise be prohibited by the HIPAA Privacy Rule.

What Is Use and Disclosure of Protected Health Information?

Protected health information (PHI) is individually identifiable health information that is transmitted or maintained by electronic or any other form or medium. Use of PHI is the sharing, employment, application, utilization, examination, or analysis of PHI within a covered entity. Disclosure is the release, transfer, provision of access to, or divulging in any other manner of PHI outside of the covered entity holding the information.

What is the Scope of the HIPAA Military Command Exception?

Under the HIPAA Military Command Exception, a covered entity may disclose the PHI of service members for authorized activities to appropriate military command authorities. This exception does not require covered entities to disclose PHI to commanders, it only permits the disclosure. If disclosure is made, then only the minimum amount of information necessary should be provided, per the HIPAA Privacy Rule. Further, the Exception does not permit a Commander’s direct access to a service member’s electronic medical record, unless otherwise authorized by the service member or the HIPAA Privacy Rule.

Appropriate military command authorities include commanders who exercise authority over a service member, or another person designated by a commander.

Authorized activities for which PHI may be disclosed to a commander include, but are not limited to:

Determining the member’s fitness for duty;
Fitness to perform a particular assignment; or
Carrying out any other activity essential for the military mission.

What about Records of Mental Healthcare and Substance Abuse?

In 2011, the Department of Defense issued Instruction Number DoDI 6490.08. The Instruction was issued as part of an effort to dispel stigma in providing mental healthcare to Armed Forces personnel.

What Information May be Disclosed Under DoDI 6490.08?

Department of Defense healthcare providers may not notify an Armed Forces service member’s commander when the member obtains mental healthcare and/or substance misuse education services, unless one of the below conditions or circumstances apply. If they apply, then disclosure by the Department of Defense healthcare provider is required.

Harm to self. There is a serious risk of self-harm by the member.
Harm to others. There is a serious risk of harm to others. This includes any disclosures concerning child abuse or domestic violence.
Harm to mission. There is a serious risk of harm to a specific military mission.
Special personnel. The member is in the Personnel Reliability Program or has mission responsibilities of such potential sensitivity or urgency that normal notification standards would significantly risk mission accomplishment.
Inpatient care. The member is admitted or discharged from any inpatient mental health or substance misuse treatment facility.
Acute medical conditions interfering with duty. The member is experiencing an acute mental health condition or is engaged in an acute medical treatment regimen that impairs the member’s ability to perform assigned duties.
Substance misuse treatment program. The member has entered into, or is being discharged from, a formal outpatient or inpatient treatment program for the treatment of substance misuse.
Command-directed mental health evaluation. The mental health services are obtained as a result of a command-directed mental health evaluation. The notification is based on other special circumstances in which proper execution of the military mission outweighs the interests served by avoiding notification, as determined on a case-by-case basis by a covered entity.