DOT reports on medical information security, data-sharing

July 1, 2010

A report from the Department of Transportation's Office of Inspector General has identified 15 recommendations for improving the security of airmen's medical information and the process of identifying pilots with current medical certificates who are receiving disability pay.

The report is the result of a two-year study to determine if airmen's personally identifiable information is properly secured from unauthorized use or access, and to assess the FAA's progress in establishing mechanisms to identify airmen holding current medical certificates while receiving disability pay. The FAA concurred with 14 of the inspector general's 15 recommendations and outlined the actions it has already taken and will take to address the office's concerns.

The study was prompted by an investigation by the Social Security Administration Inspector General into cases involving fraudulent claims for disability compensation, which in 2007 identified airmen with FAA medical certificates who were receiving Social Security disability benefits, but who failed to disclose the conditions related to those benefits on their medical applications. Receiving disability benefits does not necessarily disqualify someone from receiving a medical certificate, but airmen are required to disclose medical conditions on the medical application.

AOPA testified at a resulting hearing before the House Committee on Transportation and Infrastructure's aviation subcommittee, warning that the measures taken to address fraud should not take resources away from the timely issuance of medical certificates or other services related to safety of flight.

“It is paramount that any data-sharing plan does not negatively impact the FAA's ability to ensure the safety of the flying and nonflying public by re-tasking the FAA's limited resources to non-safety related issues,” AOPA testified.

The subcommittee requested an audit of the Airman Medical  Support Systems to assess how well the FAA prevents unauthorized or inappropriate access to airmen medical information and to evaluate its efforts to close the gaps in coordination with other agencies to root out medical discrepancies. The report's recommendations address technology shortfalls and perceived weaknesses in eliminating access of FAA Aviation Medical Examiners (AMEs) and their staff to inactive airman records and of separated AME staff to secure FAA medical systems. The audit also recommended that, although educational outreach to AMEs was ongoing, AMEs and their staff be required to participate in security and privacy awareness training.

AOPA will meet with the federal air surgeon to voice its concerns and will continue to monitor the FAA's implementation of the recommendations to ensure the safety of association member's data and identity. 

The report also encouraged the FAA to finalize arrangements with the Social Security Administration and other disability benefits providers to establish target completion dates for performing computer matching to identify airmen applying for, or holding, medical certificates and receiving disability benefits. This sort of coordination with an outside agency would require considerable resources, the FAA noted in its response to the latter.

“The FAA needs physicians, program analysts, attorneys and paralegal specialists to implement and carry out a national program to investigate alleged instances of falsification, prepare appropriate documentation in support thereof, and carry out enforcement actions consistent with the Federal Aviation Regulations,” the response says. AOPA acknowledged this personnel challenge when the association testified before the House aviation subcommittee in 2007 and continues to express concern that such a program could have significantly adverse effects on other FAA responsibilities, including airman medical certification, a task that already suffers substantially from processing delays.

The association offered a four-point plan in 2007 to address the committee's concerns about unreported conditions in medical applications. First, the FAA should add a statement to the medical certification application warning pilots that some medical data would be shared with other agencies. Second, a one-year amnesty program should be implemented to encourage pilots to report all medical visits and conditions to the FAA. The FAA implemented a similar policy this year for the use of SSRI medications to treat depression, and the DOT inspector general's report included a recommendation for an amnesty period.

Third, AOPA called for the FAA to establish a data-sharing program with other public agencies such as the Social Security Administration, within the limits permitted by the Privacy Act. The association recommended that instead of an extensive, overhead-heavy program, the FAA provide a random sampling of medical applications to the SSA for cross-checking.

Finally, AOPA offered to work with the subcommittee and the FAA to educate pilots about properly reporting all pertinent medical information, and about the severe penalties and safety consequences of failing to do so. AOPA Online offers many resources to help pilots understand the FAA's medical certification process, and the Pilot Information Center staff is highly knowledgeable about the potential for legal enforcement action in falsifications of medical applications.