Aviation safety depends on two competing imperatives: pilots must be mentally fit to fly, yet they also deserve robust protection of their medical privacy. High-profile pilot suicides, like the 2015 Germanwings 9525[1] and 2025 Air India 171[2] commercial airline crashes, have sharpened regulatory focus on mental health. In response, the Federal Aviation Administration (FAA) in 2024–25 expanded its antidepressant policy[3], convened an Aviation Rulemaking Committee (ARC) to propose reforms[4], and activated the Pilot Records Database (PRD) with privacy controls.[5] The central legal questions now cluster around the FAA’s scope in medical certification, the interplay of HIPAA, the Privacy Act, and PRD rules over health data, and whether reforms can reduce stigma without compromising safety.
Under U.S. law, pilots must hold valid FAA medical certificates, and certain psychiatric diagnoses, like bipolar disorder, are categorically disqualifying unless mitigated through a special issuance review.[6] A central risk is that pilots fearing disclosure will suppress their seeking treatment, and the 2024 Mental Health ARC, commissioned by the FAA, acknowledged that current disclosure and screening rules discourage pilots from seeking care.[7] The ARC’s report identifies stigma, career risk, and opaque processes as deterrents.[8] The FAA’s liberalized antidepressant policy and potential narrowing of mandatory therapy reports aim to reduce that chilling effect, but if pilots still perceive disclosure as penal and unpredictable, they may continue to conceal conditions, defeating regulatory goals.[9]
Once a pilot’s mental health is assessed and disclosed, that data flows through overlapping legal regimes: HIPAA, the Privacy Act, and the PRD’s statutory and regulatory constraints. Health care providers, like therapists and psychiatrists, generally qualify as HIPAA “covered entities.”[10] HIPAA allows disclosures of Protected Health Information (PHI) only as required by law, pursuant to the patient’s authorization, or under narrow public interest exceptions.[11] FAA is not itself a covered entity.[12] Thus, a clinician’s duty is to resist overbroad FAA demands, disclosing only as permitted by statute or permissible authorization.
Once a pilot’s medical data reaches the FAA, it becomes part of a federal system of records subject to the Privacy Act of 1974.[13] The FAA must maintain strict controls: access only on a need-to-know basis, disclosure only via written consent or well-defined “routine uses,” and correction rights.[14]This imposes a public-law ceiling beyond HIPAA’s clinical floor.
Congress enacted the Pilot Records Database Act, directing the FAA to create a centralized database.[15] In June 2021, the FAA promulgated 14 C.F.R. Part 111[16], replacing the older Pilot Records Improvement Act (PRIA)[17]scheme with an electronic PRD.[18] Operators are required to report certain records and review PRD data when hiring.[19] In 2021, the Department of Transportation published a Privacy Impact Assessment (PIA) for PRD, confirming that PRD stores structured data, limits access, and establishes retention and amendment rights.[20] However, even structured data can lose nuance; when PRD entries omit context, routine events, like a training pause during depression, may appear as negative marks, underscoring the need for careful interpretation by operators and clearer legal boundaries from the FAA and courts on permissible inference.[21]
The legal architecture thus offers a tiered privacy scheme: HIPAA shields clinician-held data; the Privacy Act governs FAA use; and PRD rules govern hiring dissemination, but leave open significant issues of context, accuracy, and due process.
In contrast to the U.S. voluntary model, the European Union Aviation Safety Agency (EASA) adopted mandatory psychological assessment for pilot candidates following the Germanwings crash, more frequent medical evaluations, and institutionalized peer support and mental health training.[22] The U.K. and European Union require peer-to-peer support programing, whereas the FAA merely recommends them for all U.S. airlines.[23] The European model favors upfront screening[24]; the U.S. has aimed instead to destigmatize treatment and expand safe return paths.[25] Although upfront psychological screening offers the promise of earlier risk detection, evidence from the U.S. context shows that such scrutiny may heighten pilots’ perceptions of career jeopardy, creating disincentives to self-report or seek treatment.[26]This dynamic mirrors, albeit to a lesser degree, the resistant observed among Asian pilots, where cultural norms disfavor mental health disclosure and airline and union practices reinforce stigma.[27] U.S. law must therefore balance safety and privacy in contexts where stigma remains potent.
In response, U.S. airlines have begun implementing programs designed to support pilot mental health while preserving confidentiality under the existing framework. In 2011, American Airlines established Project Wingman, a peer-to-peer support program designed to offer pilots a confidential space to discuss personal or professional concerns without fear of disclosure or adverse consequences.[28] Today Project Wingman operates a 24/7 helpline staffed by more than forty trained volunteer pilots.[29] Building on this model, the Center for Aviation Mental Health (CAMH) was founded in 2018 by Dr. Charlie Curreri, a retired A-320 captain and creator of Project Wingman, to assist pilots and aviation workers seeking mental health support.[30] In addition to providing confidential counseling services, CAMH advises airlines on the development and implementation of peer support programs.[31]
Nevertheless, additional regulatory and institutional measures are necessary to meaningfully align aviation safety with individual privacy. The FAA should narrow disclosure rules, clarify recordkeeping procedures, and improve oversight transparency. Mandatory reporting should be limited to conditions that demonstrably impair flight performance, such as acute psychiatric episodes, medication side effects, or hospitalizations.[32] Routine counseling or preventive mental health visits should not trigger mandatory disclosure.[33] Structured narrative fields or coded qualifiers could distinguish between preventive care and performance-related incidents.[34] The FAA should also establish firm timelines for medical reviews and special-issuance decisions to reduce indefinite grounding periods that discourage disclosure.[35]Finally, Aviation Medical Examiners should receive enhanced training on mental health assessment and implicit bias[36], and the FAA should expand confidential peer-support programs similar to those used by the Air Line Pilots Association.[37] Collectively, these reforms would strengthen both procedural fairness and public safety by normalizing treatment and reducing stigma.
Aviation law is evolving toward a public-health framework that lowers barriers to care, evaluates individualized risk, protects privacy once disclosed, and limits coercive measures to cases of genuine operational impairment.[38] The 2024–25 FAA reforms, expanded antidepressant approval[39], ARC proposals for nondisclosure buffers[40], and privacy-oriented PRD operations[41] mark forward movement. The coming legal battleground will be formalizing disclosure triggers, embedding due-process protections within PRD, and ensuring medical oversight respects both safety and dignity. If regulators align incentives with fairness and transparency, being fit to fly need not come at the cost of personal privacy.
[1] Tariq Pasha & Paul R.A. Stokes, Reflecting on the Germanwings Disaster: A Systematic Review of Depression and Suicide in Commercial Airline Pilots, 9 FRONT. PSYCHIATRY 86 (2018), https://doi.org/10.3389/fpsyt.2018.00086.
[13] 5 U.S.C. § 552a (2025)); U.S. DEP'T OF TRANSP., DOT/FAA 811 Employee Health Record System; Notice of Modified System of Records, 87 Fed. Reg. 55,229, 55751-52 (Sept. 7, 2022) (Docket No. OST–2022–0074).
[14]DOT/FAA 811 Employee Health Record System, supra note 13.
Comments