THE MILITARY COMMAND EXCEPTION TO HIPAA’S PRIVACY RULE:
TIME TO REDRAW THE LINE
Led by a delicate and tender prince,
Whose spirit with divine ambition puff’d
Makes mouths at the invisible event,
Exposing what is mortal and unsure
To all the fortune, death and danger dare,
Even for an egg-shell.1
INTRODUCTION
The military does not stand still. Since April 9, 2009, President Barack Obama
announced that Department of Defense (DoD) and Department of Veteran Affairs (VA) would
collaborate on a program to create Virtual Lifetime Electronic Records from the day of a
servicemember (SM) enlists until the remainder of her life in the VA system.2 A key part of the
electronic records are a SM’s electronic health records (EHR). Since 2014, DoD still has to
decide on awarding its $11 billion contract award to modernize DoD’s EHR system.3
Even First Lady Michelle Obama and Dr. Jill Biden do their part to support SMs in the
Joining Forces initiative. Under the initiative, the First Lady and Dr. Biden focus on
employment, education and wellness areas affecting SMs, veterans, and their families. 4
1
William Shakespeare, “Good Sir, Whose Powers Are These?” from Hamlet, Act IV. Sc. 1, in
WAR AND THE POET: AN ANTHOLOGY OF POETRY EXPRESSING MAN’S ATTITUDES TO WAR FROM
ANCIENT TIMES TO THE PRESENT 68–69 (Richard Eberhart & Selden Rodman eds., Greenwood
Press 1974) (1945).
2
Examining the Progress of Electronic Health Record Interoperability Between the U.S.
Department of Veterans Affairs and U.S. Department of Defense: Hearing Before the Subcomm.
on Oversight & Investigations, 111th Cong. 1 (2009) [hereinafter Examining the Progress of
EHR] (statement of Harry E. Mitchell, Chairman, Subcomm. on Oversight & Investigations).
3
Kyle Murphy, Wash. Health System Pilots IBM-Epic EHR Platform for DHMSM, EHR
INTELLIGENCE (Jan. 16, 2015), https://ehrintelligence.com/2015/01/16/wash-health-systempilots-ibm-epic-ehr-platform-for-dhmsm/.
4
About Joining Forces, WHITE HOUSE, https://www.whitehouse.gov/joiningforces/about (last
visited Mar. 30, 2015).
1
More recently, a blue-ribbon compensation panel proposed that the health plan ran by
DoD shift to the private sector. The plan ran by the largest employer in the United States.5 The
plan that serves nearly 9.2 million beneficiaries.6
Yet, despite all these developments related to DoD, not much has been written about
health privacy of SMs. The existing literature primarily focuses on the Army.7 Or, for the
literature that that addresses the health privacy of military-wide SMs, the discussion has focused
only on specific health conditions.8
This Paper aims to fill a gap. Specifically, I argue that the current Military Command
Exception (MCE) to the Privacy Rule of the Health Insurance Portability and Accountability Act
(HIPAA) raises several healthcare and legal issues, and propose a multi-step process to eliminate
the MCE. Part I provides a factual and legal background surrounding the MCE. Part II analyzes
the issues around the MCE, especially the reasons for the issues and how these issues arise. Part
5
About the Department of Defense, DEFENSE.GOV, http://www.defense.gov/about/ (last visited
Apr. 3, 2015).
6
Patricia Kime, Tricare Choice: What’s in It for You?, MILITARY TIMES (Mar. 16, 2015),
http://militari.ly/1bbi6Jl.
7
Michael J. Benjamin, Commander’s “Right to Know” Health Information: A Strategically
Flawed Innovation 27 (Mar. 21, 2011) (unpublished manuscript); Tamar Tavory, Medical
Confidentiality in the United States Armed Forces, 3 IDF L. REV. 209, 234–35 (2007–08).
8
Jennifer A. Neuhauser, Lives of Quiet Desperation: The Conflict Between Military Necessity
and Confidentiality, 44 CREIGHTON L. REV. 1003, 1003 (2011) (mental health); Emily Hansen,
Comment, Carry that Weight: Victims of Privacy Within the Military Sexual Assault Reporting
Methods, 28 J. MARSHALL J. COMPUTER & INFO. L. 551, 571–73, 584 (2011) (military sexual
trauma). Underlying some of the health-related issues may be gender inequality issues. However,
military sexual trauma does not only occur to female SMs. Indeed, the total numbers of SMs,
male and female, who suffer from this trauma are about the same. That is because, overall, a
larger number of male SMs serve in the military. Carter Center, After the War: Mental Health
and a Veteran’s Journey Home (2010) (downloaded using iTunes). For literature on conditions
more tangentially related to health, see Laura Ahern & Ivy Cherian, Note, Abortion & the
Military: Limitations on Access for Servicewomen, 31 HOFSTRA LAB. & EMP. L.J. 429, 437
(2014) (abortion); Temidayo L. Anderson, Navigating HIPAA’s Hidden Minefields: A Leader’s
Guide to Using HIPAA Correctly to Decrease Suicide and Homicide in the Military, ARMY
LAW., Dec. 2013, at 15, 16 (high-risk behavior).
2
III proposes recommendations to solve the issues: (1) starting with a multi-stage way to eliminate
the MCE and implement ongoing training, and then (2) addressing possible opposition and
practical concerns around the recommendations. Part IV concludes with a summary of the
importance of SMs’ health privacy, and a summary of the recommendations.
I.
BACKGROUND
The MCE affects many areas of military life, law, and policy.
A.
THE MILITARY SETTING
As of early April 2015, DoD is actively involved in two conflicts.9 These two conflicts
are the Operation Inherent Resolve in Iraq and Syria,10 and a continuing mission in
Afghanistan.11 Other than these conflicts in the Middle East, DoD’s buildings are located in more
than 5,000 locations around the globe.12
As a matter of organization, SMs may serve in the Army, the Navy, the Marine Corps,
and the Air Force.13 As of early 2015, the numbers within each of these units were: 498,401 in
the Army, 324,911 in the Navy, 184,781 in the Marine Corps, and 312,283 in the Air Force.14
These figures only provide a basic view of DoD, since service is a complex process. Out
9
Though DoD also has an outreach effort in Pakistan. Cheryl Pellerin, Obama Extends U.S.
Troop Levels to Boost Afghan Security, DEFENSE.GOV (Mar. 25, 2015),
http://www.defense.gov/news/newsarticle.aspx?id=128449&source=GovDelivery.
10
Operation Inherent Resolve, DEFENSE.GOV,
http://www.defense.gov/home/features/2014/0814_iraq/ (last visited Apr. 3, 2015).
11
Afghanistan Resolute Support, NATO.INT, http://www.rs.nato.int/mission.html (last visited
Apr. 3, 2015).
12
About the Department of Defense, supra note 5.
13
OFFICE OF THE SEC’Y OF DEF., ORGANIZATION OF THE DEPARTMENT OF DEFENSE 1 (2012).
14
Active Duty Military Personnel by Rank/Grade, DEP’T OF DEF. (Jan. 31, 2015),
https://www.dmdc.osd.mil/appj/dwp/dwp_reports.jsp.
3
of DoD’s force, 1.1 million serve in the National Guard and Reserve forces.15 Additionally, for
some SMs, deployment may be an ongoing process; after one deployment, a SM may decide to
serve again and again.16
In some ways, deployment of SMs makes DoD an employer unlike any other. Yet, in
other ways, a SM’s relationship with DoD is like many other civilian employers. Recent career
guides suggest that, through service, SMs acquire many skills that would allow them to move
between civilian work and military service.17
B.
THE MILITARY HEALTHCARE SYSTEM
An SM receives care from the military healthcare system in many care areas, including
from DoD and private providers belonging to DoD’s care plans. Additionally, because of service,
upon retirement, SMs may receive care through specific civilian systems.
1.
Care Areas
As a system with a $49 billion annual health budget, DoD provides care in numerous
areas.18 These areas include “inpatient and outpatient services, medical and surgical care, mental
health and substance abuse treatment, maternity care and pediatrics, preventive care and more.”19
(Because different health privacy laws control substance abuse20 and mental health treatment,21
these areas are not the focus of this Paper.)
15
About the Department of Defense, supra note 5.
16
C.J. HENDERSON & JACK DOLPHIN, CAREER OPPORTUNITIES IN THE ARMED FORCES v (2d ed.
2007).
17
Id. at v–vi.
18
Kime, supra note 6.
19
Id.
20
E.g., Dep’t of Def. Instruction 6490.08, 3.a (Aug. 17, 2011).
21
E.g., Dep’t of Def. Health Information Privacy Reg. 6025.18-R, C1.2.3.1 (Jan. 24, 2003).
4
Medical science advancements are a key component to care offered within DoD, but not
all changes in the military health system happen due to more research. Medical science
advancements, for example, are related to traumatic brain injury (TBI)22 among SMs. With TBI,
medical science is related to the condition in two ways. First, medical research helps providers
better understand the condition.23 Also, the advancements, particularly in combat medicine, are
related to the occurrence of TBI among SMs. Because the advancements ensure that fewer SMs
die, more surviving SMs risk incurring TBI.24
Other changes in the military health system are mainly due to change in the composition
of SMs. For example, with the growing enlistment of female SMs, access to abortion has become
a growing area of concern in military care.25
2.
Care Plans
In DoD, TRICARE is the primary unit that offers various plans to SMs and their
families.26 TRICARE’s plans offer a mix of options, including plans that allow greater choice of
civilian providers,27 reduced prices for TRICARE’s network providers,28 plans for reserve
22
TBI is a physical condition that occurs due to extreme pressure to the brain area. Micah
Garbarino, Coming to Terms, AF.MIL (Mar. 21, 2015),
www.af.mil/DesktopModules/ArticleCS/Print.aspx?PortalId=1&ModuleId=850&Article=58112
1. Researchers developed several methods of measuring the severity of TBI.
23
INVISIBLE WOUNDS OF WAR: PSYCHOLOGICAL AND COGNITIVE INJURIES, THEIR
CONSEQUENCES, AND SERVICES TO ASSIST RECOVERY 7 (Terri Tanielian & Lisa H. Jaycox, eds.,
2008) [hereinafter INVISIBLE WOUNDS OF WAR].
24
Id. at 6.
25
Ahern & Cherian, supra note 8, at 437.
26
ABA, THE LEGAL GUIDE FOR MILITARY FAMILIES: EVERYTHING YOU NEED TO KNOW ABOUT
FAMILY LAW, ESTATE PLANNING, AND THE SERVICEMEMBERS CIVIL RELIEF ACT 237 (2013).
27
Id. at 238 (TRICARE Standard).
28
Id. (TRICARE Extra).
5
members,29 and even plans for care abroad.30
Furthermore, for separated SMs, they may be eligible for VA31 care. Generally, eligibility
for VA care takes into account many factors, such as condition of separation, minimum period of
service, and discharge due to disability.32 Most recently, VA extended eligibility for most
separated SMs who served in combat during Operation Enduring Freedom/Operation Iraqi
Freedom/Operation New Dawn.33
3.
Providers
As discussed, TRICARE offers plans to SMs that allow SMs to seek civilian providers.
Still, given that the proper military healthcare system has a budget of $49 billion per year,
military provider facilities are also extensive. Finally, upon separation from service, because not
every SM may be eligible for VA care, the separated SM may seek care from private providers.34
C.
THE LAW35 AND THE POLICY
1.
The MCE and Its Background
29
Id. at 239 (TRICARE Reserve Select).
30
Id. at 238 (TRICARE Standard Overseas: International SOS).
31
For simplicity, VA stands for the department’s three organizations: (1) the Veteran Health
Administration, (2) the Veteran Benefits Administration, and the National Cemetery
Administration. VA = VHA, VBA, & NCA, VA.GOV,
http://www.va.gov/JOBS/VA_In_Depth/oneva.asp (last reviewed or updated Nov. 9, 2009).
32
See generally Veteran Eligibility, VA.GOV, http://www.va.gov/HEAL
THBENEFITS/apply/veterans.asp (last visited Mar. 25, 2015)
33
Returning Servicemembers, VA.GOV, http://www.va.gov/HEAL
THBENEFITS/apply/returning_servicemembers.asp (last visited Mar. 25, 2015)
34
See Veteran Eligibility, supra note 32 (noting that only some veterans are eligible for care).
35
This Section focuses on statutes and regulations. However, some scholars have discussed the
constitutional questions that military health privacy raises. E.g., Dane B. Getz, Closing the Gap
in Access to Military Health Care Records: Mandating Civilian Compliance with the Military
Command Exception to the HIPAA Privacy Rule, ARMY LAW., July 2014, at 4, 18; Tavory, supra
note 8, at 219–24.
6
In pre-HIPAA times, commanders’ access of SMs’ health information was mainly
governed by the Privacy Act. The Privacy Act36 is the default statute controlling practices of
federal government data.37 Under the Privacy Act, as promulgated by DoD, commanders could
access SMs’ health information if commanders met a “need to know” test.38
Then came HIPAA. HIPAA, originally enacted in 1996, was a suite of laws where
Congress primary aimed to increase the effectiveness of healthcare through encouraging the use
of electronic technology.39 Under the authority provided in the HIPAA statute, the Department of
Human and Human Services (HHS) issued regulations promulgating this statute.40 Most notably,
HHS issued the Privacy Rule.41 Under the Privacy Rule, before a defined group of healthcare
entities may disclose a given individual’s defined health information, the entities must generally
acquire informed consent from the individual.42 In the alternative, the Privacy Rule must
expressly allow for the entities to disclose the information.43 One of the expressed ways that the
Privacy Rule allows disclosure is through defining a mechanism around which military
commanders may request the entities to disclose SMs’ health information.44
It is mainly from citing the authority of that mechanism that DoD promulgated its own
36
5 U.S.C. § 552a (2012).
37
Anderson, supra note 8, at 24.
38
Dep’t of Def. Privacy Program 5400.11-R, C4.2.1.1 (Aug. 1983).
39
Tavory, supra note 7, at 211.
40
For more details on the history behind HIPAA, see Lawrence O. Gostin & James G. Hodge,
Jr., Personal Privacy and Common Goods: A Framework for Balancing Under the National
Health Information Privacy Rule, 86 MINN. L. REV. 1439, 1457–58 (2002).
41
Kristy Radio, Why You Can’t Always Have It All: A Trial Counsel’s Guide to HIPAA and
Accessing Protected Health Information, ARMY LAW., Dec. 2011, at 4, 4.
42
Anderson, supra note 8, at 17.
43
Id.
44
45 C.F.R. 164.512(k)(1)(i) (2013).
7
regulation, the DoD Health Information Privacy Regulation45 (DoD 6025.18-R). DoD 6025.18-R
is a 118-page text that echoes many terms of the Privacy Rule, but as applied to the military, and
that establishes the MCE.46 Similarly to the Privacy Rule, the defined group of entities under
DoD 6025.18-R means DoD covered entities (CEs) such as DoD health plans and providers;47
the health information is defined as protected health information (PHI) that includes individually
identifiable information CEs keep.48 Except expressly permitted for disclosure,49 DoD CEs must
obtain a SM’s informed consent.50
The MCE involves a complex interaction between commanders, designees, and CEs. As
an initial matter, commanders are figures “who exercise authority” over SMs,51 and designees
are who commanders select to receive PHI “in order to carry out an activity under the authority
of the Commander.”52 The MCE generally allows a CE to disclose PHI to commanders and
designees to “assure the proper execution of the military mission.”53 DoD 6025.18-R includes a
list of purposes that qualify as “to assure the proper execution of the military mission.”54 They
include: determining fitness for duty, fitness to perform a mission, and to report on casualties.55
45
6025.18-R (Jan. 24, 2003)
46
This Paper discusses only the DoD regulations promulgating the Privacy Rule. DoD units
further promulgate the DoD regulations through their own regulations. E.g., Dep’t of the Army
Reg. 40-66 (Jan. 4, 2010); Dep’t of Air Force Instruction 41-210 (Aug. 14, 2014).
47
Dep’t of Def. Health Information Privacy Reg. 6025.18-R, DL1.1.3.
48
Id. DL1.1.28.
49
Id. C5.1.1.
50
Id. C5.3.1.
51
Id. C7.11.1.2.1.
52
Id.
53
Id. C7.11.1.1.
54
Id. C7.11.1.3.
55
Id. C7.11.1.3.1–.5.
8
Finally, the MCE also proscribes certain responsibilities for the CE. To start with, the
decision of the CE to disclose PHI is discretionary.56 However, once the CE agrees to disclose
PHI to a commander or designee, the CE must take measures to ensure that the disclosure meets
the “minimum necessary” standards57 and must generally make it available, for a SM, an
accounting of the MCE disclosures regarding that SM.58
2.
Laws Related to the MCE
Commanders may acquire SMs’ health information through the MCE, but the MCE is by
no means the only way that commanders may do so. First, commanders may receive completed
screening forms from SMs.59 For example, medical screening forms for potential enlistees collect
detailed medical history and contacts of these enlistees’ primary care providers.60
Second, DoD 6025.18-R defines appointment scheduling information as separate from
SMs’ PHI. Specifically, DoD 6025.18-R establishes that the scheduling information falls under
HIPAA’s “treatment” exception61 and, as such, military providers may supply commanders and
designees with SMs’ appointment scheduling information. Such information includes missed and
cancelled appointments.62 Unlike disclosures under the MCE, CEs need not make it available for
an SM an accounting of information shared under the “treatment” exception.63
56
Id. C7.11.1.1.
57
Id. C8.2.1.
58
Id. C13.1.1.
59
Neuhauser, supra note 8, at 1023.
60
See generally DD Form 2807-1 (Mar. 2015); DD Form 2807-2 (Mar. 2015).
61
Dep’t of Def. Health Information Privacy Reg. 6025.18-R, C4.2.
62
TMA PRIVACY & CIVIL LIBERTIES OFFICE, MILITARY COMMAND EXCEPTION AND DISCLOSING
PHI OF ARMED FORCES PERSONNEL 4–5 (2013).
63
Dep’t of Def. Health Information Privacy Reg. 6025.18-R, C13.1.1.1.
9
3.
Recent Health Privacy Policies
Since DoD promulgated 6025.18-R in 2003, DoD has initiated policies addressing SMs’
health conditions. In 2011, DoD issued an instruction addressing the issue of social stigma
related to SMs seeking mental health care.64 While the instruction did not alter the MCE, it did
instill a policy that providers should not readily notify commanders in situations where SMs
sought mental health care.65
D.
LEGAL THEORIES SURROUNDING MILITARY HEALTH PRIVACY
The MCE involves legal theories around military health privacy, and, since theories of
military health privacy really involve an intersection of several legal areas, it is worth discussing
each in more detail. As an initial matter, scholars touching on military data privacy have mainly
discussed the area under general theories privacy of government data.66 According to Professor
Froomkin, privacy of government data is distinguishable from privacy of private-held data,
because, unlike private entities, the government acts in multiple roles. While the law may require
private entities to request individuals to disclose data, the government is both the actor in
requiring disclosure of data as well as the actor enacting the law requiring the disclosure.67 In the
context of military health privacy, Professor Froomkin’s observation applies. Unlike private
health systems, DoD is both the entity requiring disclosure of SMs’ data as well as the entity
promulgating the regulations requiring disclosure.
Military health privacy is also related to theories of health privacy, because the
information on SMs is after all health data. According to Professors Gostin and Hodge, health
64
Dep’t of Def. Instruction 6490.08, 3.a (Aug. 17, 2011).
65
Id. 3.b.
66
See A. Michael Froomkin, Government Data Breaches, 24 BERKELEY TECH. L.J. 1019, 1023
(2009) (providing the example of “military records” along with other kinds of data).
67
Id. at 1025.
10
privacy involves an interrelated relationship between individual rights and public health. As it
relates to individual rights, allowing an individual to control his own health data allows the
individual to fulfill his life goals.68 Traditionally, the individual’s right to control translates into
the ethical rules binding therapeutic physicians, rules that create a confidential relationship
between a physician and her patient.69 As it relates to public health, sufficient data is necessary to
ensure a healthy population.70 Policies that implement public health goals include reporting of
infectious diseases.71 Under Professors Gostin and Hodge’s theory, proper health privacy policy
ensures that individual rights and public health goals are met. Individuals will candidly disclose
their health information, which ensures that there is sufficient data to treat the general public.72
Finally, military health privacy also involves theories of data privacy in general.
According to Judge Posner, data privacy really involves a question of economic incentives.73 An
individual’s decision to disclose or to restrict data is really based on an assessment of costs and
benefits of the decision.74 As such, Judge Posner would employ law and economics tools to
recommend that legal mechanisms protecting data not be unduly intrusive, and be weighed
against letting individuals exploit their superior knowledge or skills.75
II.
ANALYSIS OF ISSUES
The MCE implicates a host of issues, and these issues are mainly centered in four areas:
68
Gostin & Hodge, supra note 40, at 1448.
69
Id. (describing the origins in the Hippocratic Oath).
70
Id.
71
Id. at 1445.
72
Id. at 1455.
73
Richard A. Posner, The Right to Privacy, 12 GA. L. REV. 393, 394, 400 (1978)
74
Id. at 404.
75
Id.
11
(1) issues related to SMs’ unwillingness to seek care, (2) factors that magnify the issues, (3)
issues related to the lack of certainty about MCE, and (4) issues related to lack of oversight.
A.
NOT SEEKING CARE
As a preliminary matter, the consequences of SMs not seeking care affect many
healthcare actors in the present and in the future. In the present, improper care of SMs affects the
military health system and private providers. And, in the future, when the SMs’ care will be in
the hands of civilian, the consequences will affect the VA and private actors.
SMs generally have various career-related and some social reasons for not seeking care.
These reasons originate from trust issues and stigma that takes occur in the military setting.
1.
Trust Issues and Social Stigma
In more subjective terms, SMs cannot seek care because the military environment does
not engender in SMs a sense that it is an environment that can be relied on. Yet, this sense of
reliance, or trust, is important to SMs suffering from injury. For example, in the context of
military sexual trauma,76 being able to voice about the injury is key. Victims of the trauma may
wish to share the information with friends or family members.77
Given the importance of trust, shouldn’t SMs be able to find it? Unfortunately, due to
regulations such as the MCE, SMs feel that they cannot trust their providers, leaders,78 or
commanders.79 Indeed, the general culture in the military is that SMs should keep a stiff upper
76
Military sexual trauma refers to a condition that resulted from a physical injury or harassment
of sexual in nature, which occurred in the military context. Hansen, supra note 8, at 570.
77
Id. at 557–58.
78
Leaders mean those SMs reporting to commanders and who also supervise other SMs.
79
Benjamin, supra note 7, at 20.
12
lip and not “whine.”80 In the case of the SM who suffers from sexual trauma, she is unlikely to
confide in her provider, leader, or commander.
Related to an environment where a sense of trust is wanted, there is stigma of the ill.
There are two variations of this stigma. One stigma—which also occurs to some extent in the
civilian context81—is that lack of health is in some way correlated with weakness. A recent Air
Force article bears the title: “Coming to Terms: Airman Remains Resilient Through Multiple
TBIs.”82 This article, like many published in other units of DoD,83 repeat the account that there is
a sense of superiority that those who have overcome illness should feel. And, conversely, those
who have yet to “overcome” the illness are weaker.
Another stigma—which also may occur in the civilian context—is that the ill SM is a bad
actor. This stigma relies on an account that a SM directly contributed, if not caused, the injury.
Again, in the case of the SM who suffers from sexual trauma, her leader may blame the SM for
having caused the underlying sexual assault.84
2.
Career-Related Reasons
The trust issues and social stigma provide a general framework of why SMs may not seek
care, though there are two career-related rationales that build on the framework. First, an SM
may decide not to seek care because seeking care could harm his career aspirations.85 In that
80
Richard H. Carmona et al., Univ. of Ariz. Coll. of Med., What Healthcare Providers Need to
Know About Veterans (Apr. 12, 2012) (downloaded using iTunesU).
81
Jeffrey W. Stempel, Adam, Martin and John: Iconography, Infrastructure, and America’s
Pathological Inconsistency About Medical Insurance, 14 CONN. INS. L.J. 223, 251 (2008).
82
Garbarino, supra note 22.
83
E.g., Lisa Ferdinando, Face of Defense, DEFENSE.GOV (Mar. 17, 2015),
http://www.defense.gov/news/newsarticle.aspx?id=128384.
84
Hansen, supra note 8, at 580.
85
Neuhauser, supra note 8, at 1007.
13
sense, the interests underlying health privacy could be explained by economic theories and
individual rights theories.
Second, an SM may decide not to seek care because she wants to end her deployment
ASAP. For such SMs, their main goal is to take the shortest path to return home.86 In that sense,
the interests underlying health privacy can be explained by individual rights theories.
3.
Social Reasons
Even for SMs who do not have career-related reasons to not seek care, trust issues and
social stigma contributes to these SMs’ social standing among their peers. The military is
notorious for creating camaraderie among SMs and their peers.87 For better or for worse, SMs
and their peers become brothers in arms. As such, SMs may have social reasons to avoid
changing their standing among their peers, even if that means not seeking care.88
B.
AGGRAVATING FACTORS
The literature around military health law provides three factors that magnify the harm
that comes about due to issues around the MCE, and these factors start from the most commonly
present in the literature to the least commonly present.
1.
SMs’ Access to Weapons
By training, most SMs have access to weapons. In the military, firearms and ammunition
are the SMs’ bread and butter.89 Yet, the military is also a setting where SMs are hesitant to seek
care when they suffer from injury. Those injuries and harm do not need to be of mental health or
86
Carter Center, supra note 8.
87
Carmona et al., supra note 80.
88
Benjamin, supra note 7, at 11.
89
Anderson, supra note 8, at 20; Neuhauser, supra note 8, at 1025
14
substance abuse in nature. Physical injuries such as TBI, or just the mere access to firearms,90
magnify the risk of SMs in committing harm to others and to themselves.91
2.
Desirability that SMs Be Involved in Their Care
While the military setting already places a barrier for SMs to seek care, even for those
who overcome the barrier, further barriers lie ahead. In DoD’s health system, SMs have the main
responsibility to ensure that their care is good.92 That responsibility translates into being
proactive and diligent,93 especially by expressing and documenting one’s health conditions.94 It
is ironic that, on the one hand, SMs should hide away their medical conditions and be stoic, and,
on the other, SMs should take charge and become record-keepers of those same conditions. In
mental health, such conduct could be diagnosed as multiple personality disorder.
3.
Growing Use of Electronic Health Records
The DoD regulations providing the MCE were promulgated on January 2003, and, since
then, one of the main changes that occurred in the medical practice, including military medical
practice, is the growing use of EHR. For commanders and designees, the prevalence of EHR
means that they can more readily access the health records of SMs in electronic form. 95 For SMs,
the prevalence of EHR translates into more concern about the reach of the MCE.
C.
LACK OF CERTAINTY
Though most actors in the military, especially the military health system, are aware of the
existence of the MCE, most actors are not aware of its exact boundaries. First, the exact
90
Anderson, supra note 8, at 19.
91
Id. at 15, 19.
92
ABA, supra note 26, at 243.
93
Id.
94
Id. at 244–46.
95
See Neuhauser, supra note 8, at 1023 (stating that “most medical records are electronic”).
15
boundaries of the MCE raise several issues among those in provider facilities. For civilian
providers, they often clash with commanders. To much consternation to the commanders, the
civilian providers often respond to commanders’ requests by exercising their discretion not to
disclose SMs’ PHI.96 Most often, the civilian providers exercise their discretion because they
face a gray area between (1) the MCE and (2) these providers’ general duties under HIPAA’s
Privacy Rule and their staff’s duties to their professional boards.97
In military provider facilities, the gray area becomes even murkier. For military medical
staff, requests for PHI from commanders potentially raises the issue of (1) the MCE, (2) their
ethical duties from their professional boards, and, if the request comes from a commander who
rank higher than the medical staff, (3) the risk of defying a senior officer.98 Potentially, each of
these three sides pulls the military medical staff to make a different decision about disclosure.
Finally, even for privacy officers of military provider facilities, their practice is not
uniform. An Army major and judge advocate writes that military health privacy is an area that
lacks uniformity. “Due to the magnitude and complexity of the DODR 6025.18-R, . . . each
[facility’s privacy office] has its own way of processing [PHI] requests.”99 More uncertainty.
Now since the focus of the MCE is on the commanders, then the commanders must have
a clear mastery of the MCE, don’t they? They do not. Several judge advocates report that
commanders often wish to access more PHI than the MCE permits them to.100 For example,
96
Getz, supra note 35, at 14.
97
Id.
98
Neuhauser, supra note 8, at 1030–31.
99
Radio, supra note 41, at 11.
100
Anderson, supra note 8, at 24; Radio, supra note 41, at 11; Timothy J. Rushenberg, HIPAA: A
Military Perspective, AMERICANBAR.COM (Oct./Nov. 2007),
http://www.americanbar.org/content/newsletter/publications/gp_solo_magazine_home/gp_solo_
magazine_index/hipaamil.html.
16
some Air Force commanders are not cognizant of the specific Air Force instructions limiting the
MCE.101 Among Army commanders, there is also lack of certainty of the limitations of the MCE.
So much so that an Army major and judge advocate highlighted the need of judge advocates “to
help to prevent abuse and overreaching by commanders.”102
Last, but not least, are the SMs themselves. SMs are also not aware of the clear
demarcations of the MCE. For example, a 2007–08 survey of former SMs103 found that, in the
context of mental health, 29% of survey participants were concerned that their mental health
information does not remain in confidence with the provider.104 Similarly, in another 2010
survey of active SMs, in the context of sexual assault information, 60% answered that their
reporting of assault would not be kept in confidence.105 Both these surveys results support the
proposition that SMs do not all agree on the exact scope of the MCE.
D.
LACK OF OVERSIGHT
An area that relates to the lack of certainty in the military system is the lack of oversight.
Even if a number of actors in the military may have a clear understanding of the MCE, four
factors contribute for their lack of incentive to limit their access to SMs’ health information.
1.
Lower Protections of the Privacy Act
After a provider discloses PHI under the MCE to the commander or designee, the
information (which is no longer defined as PHI) is governed under the Privacy Act. Under the
Privacy Act, the commander or designee may disclose the health information as long as the
101
Rushenberg, supra note 100.
102
Radio, supra note 41, at 11.
103
INVISIBLE WOUNDS OF WAR, supra note 23, at 90.
104
Id. at 104.
105
Hansen, supra note 8, at 568.
17
information is needed for work-related duties.106
Thus, compared to the CEs’ restrictions under HIPAA, commanders and designees have
more discretion to disclose the information further. For example, commanders need not follow
the minimum necessary standard and need not keep a record of any subsequent disclosures.
2.
Lack of Access by Judge Advocates
The literature suggests that the main guidance commanders receive on the MCE is
through counseling of judge advocates. Thus, judge advocates would appear to be in an ideal
position to oversee whether commanders follow the MCE. In reality, judge advocates cannot
monitor the commanders. There are two reasons for this. First, not all judge advocates pay
enough attention to issues surrounding the MCE.107 What judge advocates do not know cannot
serve to monitor the commanders.
Second, judge advocates currently have fewer means to access SMs’ health information
than commanders. As an initial matter, the MCE generally does not apply to judge advocates. As
such, like any other party, judge advocates must rely on other exceptions under HIPAA’s
regulations.108 As such, even if judge advocates had an interest in monitoring commanders, the
judge advocates do not have a special legal ground to do so.
3.
Limitations Due to the Feres Doctrine
Feres doctrine refers to a line of U.S. Supreme Court cases interpreting the Federal Torts
Claims Act.109 Starting with Feres v. United States,110 the Supreme Court severally restricted the
106
Dep’t of Def. Instruction 6490.08, Enclosure 2, 3 (Aug. 17, 2011).
107
Rushenberg, supra note 100.
108
Radio, supra note 41, at 6.
109
28 U.S.C. §§ 2671 et seq. (2012).
110
340 U.S. 135 (1950).
18
right of SMs to bring civil actions against the federal government.111 In the context of the
military health system, the Feres doctrine limits medical malpractice suits that SMs may bring
against military providers.112
As such, while the first two factors mean that commanders’ actions are to a great extent
not overseen, Feres doctrine means that medical providers have fewer reasons to be accountable
to SMs. Under Feres, SMs have few venues to bring tort actions against military providers, even
if the providers’ disclosure results in serious medical harm.113
4.
Limitations of Ethics Boards
Finally, military providers—particularly their staff—have fewer reasons to be
accountable to SMs, because the staff is unlikely to be penalized for ethical violations. That is
because the ethics boards tend to defer the military in cases of ethics violations.114 Applying
situations where the MCE is at issue, even if a physician’s ethical duties may conflict with the
MCE, she has few incentives to comply with her ethical duties. Especially when a higher ranked
commander requests for a SMs’ PHI, the physician is more likely to obey her commander.
III.
RECOMMENDATIONS
A.
REGULATORY AND POLICY CHANGES
1.
The Multi-Stage Elimination of the MCE
Given the issues that the MCE raises, the MCE is unworkable. However, the elimination
of the MCE should not ignore the many actors that the exception currently affects. As such, the
111
Jonathan Turley, Pax Militaris: The Feres Doctrine and the Retention of Sovereign Immunity
in the Military System of Governance, 71 GEO. WASH. L. REV. 1, 1 (2003).
112
Id. at 57.
113
E.g., Bradley v. United States, 161 F.3d 777, 780 (4th Cir. 1998) (holding that providers are
immune for “negligence [that] began while the plaintiff was on active duty”).
114
Benjamin, supra note 7, at 22.
19
elimination of MCE should happen in several stages, with an emphasis on the different actors.
a)
Actors in Provider Facilities
Within the facilities, privacy officers should be targeted first. The privacy officers, who
interact with commanders, designees and the medical staff, could be the catalyst for change.
Additionally, privacy officers are a source of the disparate implementation of the MCE. By
eliminating the effect of the MCE among the privacy officers first, privacy officers would no
longer have the discretion to authorize the commanders’ requests. Consistent refusal of
commanders (and also their designees) would ensure consistency.
Next, the MCE should no longer be practiced among the medical staff. While the medical
staff may not have the regulatory expertise of the privacy officers, the staff often guides the
commanders who seek health information. Certainly, for the civilian medical staff, closing the
MCE eliminates for them the pressure from commanders to disclose. And, even more than the
civilian staff, eliminating the MCE among the uniformed staff would end the conflict that these
staff feels towards their patient/SMs and the military. Similarly, where a commander ranks
higher than a medical staff member, eliminating MCE would diminish the need for the staff
member risk disobeying her commander.
b)
SMs
Though SMs are not directly involved in the mechanism where providers disclose PHI to
commanders or designees, eliminating the MCE affect SMs significantly. If word goes around
that MCE has ended,115 SMs are more likely to seek care. Whether the MCE discourages SMs to
seek care due to career reasons, peer concerns, or whatever else, with the MCE gone, such
reasons or concerns would lessen. The involvement of SMs in their care is especially important
115
See infra III.B.1 for recommendations regarding ongoing training for SMs.
20
since, to ensure that the care is effective, health advocates recommend that SMs be actively
involved. Regarding career decisions, increased options for care could ultimately reduce the rate
of military talent moving to civilian positions and increase the talent in military.
Even so, eliminating the MCE does not necessarily mean that a SM may seek care and
expect none of his health information to go to the hands of his commander. Through DoD’s
interpretation of treatment, a commander may still receive information about SM in what DoD
considers “treatment” purposes.
c)
Commanders and Designees
For the first year that MCE is eliminated, commanders and designees should be immune
from any impermissible access to health information. There are two reasons for this. First, the
elimination of the MCE should be a DoD change that is approached cooperatively. For the most
part, commanders and designees relied on the MCE for a precarious setting. If the elimination of
MCE were too burdensome for commanders and designees, they would be placed between the
rock (for example, of military mission demands) and a hard place (for example, of
noncompliance with the Privacy Act).
Second, as a practical matter, the elimination of the MCE should not strain the working
relationship among providers, SMs, commanders, and designees. The elimination of the MCE
does not eliminate completely how commanders may access the SMs’ health information.
Commanders may still receive health information through screening forms and DoD’s
“treatment” exception. More broadly, as DoD continues to face conflicts around the globe, all
actors should maintain a united front.
B.
ONGOING TRAINING
Related to how the elimination of the MCE should be cordial, DoD should implement
21
ongoing training informing SMs, commanders, and their designees116 of issues surrounding
military health privacy.
1.
SMs
The training should center on the rights that SMs will have and on the interests that the
SMs’ rights are balanced against. As an initial matter, the PHI primarily flows from SMs and
thus training should start from the source. Currently, SMs have an amorphous idea how their
health information may be shared with commanders and designees; DoD should implement
training that informs SMs more clearly how the sharing of information happens. Similarly,
DoD’s training should tackle the choice that SMs have in consenting (or not) the release of PHI.
As a correlative, the training should reference the DoD policies that were implemented so far,
primarily in mental health. Referring to these policies would help the training of SMs to begin
with a frame of reference.
It is not news that SMs’ interests in health privacy clash with other interests, and SMs
should be informed of such. Currently, DoD regulation and literature employs language
referencing quite abstract interests surrounding national security.117 What about other interests?
SMs should also be informed of interests such as government accountability, the relationship
between individual rights and public health, and economic theories. Informing SMs of such
interests have three benefits. First, the knowledge of these interests help SMs make more
informed decisions. These include decisions of seeking care, how often to seek care, and, more
broadly, if the military career path offers the SMs the right amount of health privacy.
Next, the knowledge of these interests helps SMs to aid other SMs to make more
116
Since the recommendation is that the MCE should be eliminated within one year, the role of
designees would cease to exist. Designees may still play a role during the transition period.
117
E.g., Getz, supra note 35, at 9.
22
informed decisions. The military environment is quite unique in exposing SMs to the intimate
details of their peers’ lives, as such, decisions about healthcare are only one way how SMs could
help each other weigh of the different interests implicated by their decisions to seek care. More
indirectly, informing all SMs that health privacy in the military realm raises many interests
lessens the stigma among the SMs. A SM who does not seek care for a mild injury is not
necessary weak or bad, she may just be very risk averse to losing her career options.
Finally, the training around interests helps other actors. Privacy officers would be faced
with fewer questions. SMs reticent to reveal health information to medical staff would better
articulate their concerns. Commanders seeking consent to access SMs’ PHI would have more
nuanced conversations with these SMs. Ultimately, if DoD trains SMs to operate the deadliest
firearms, why wouldn’t DoD arm SMs with knowledge on health privacy?
2.
Commanders and Designees
Other than SMs, commanders—and to some extent their designees—should also receive
training. First, DoD should inform commanders and designees of the differences between
executing military mission and access to PHI. Commanders and designees should not only rely
on PHI as a litmus test of how capable their units are. Other than the PHI of SMs, factors that
affect the execution of a military mission include the recruitment rates and methods,118 the
competitiveness of civilian career choices, and factors that magnify harm. Indeed, an Army
colonel went far as to argue that unrestricted access to PHI negatively impacts military
missions.119 As a result of the training, one consequence is that commanders and designees
would be less reliant on PHI and consider what other changes they may make to ensure proper
execution of military missions. For example, commanders and designees could reorganize the
118
Carter Center, supra note 8.
119
Benjamin, supra note 7, at 25.
23
reporting structure of their chain of command, so that leaders can more readily communicate
with commanders when the leaders observe that SMs may suffer from medical conditions that
risk military mission. Access to PHI is not a panacea.
Second, DoD should inform commanders and designees of the alternatives they have to
the MCE. Commanders have access to SMs’ screening documents, SMs’ information that falls
under “treatment” purposes, and SMs’ PHI when SMs give consent. As alluded earlier,120
eliminating the MCE shifts (1) the model that commanders and designees are the agents in
access of SMs’ health information, to (2) the model that providers and SMs are the agents in
disclosing the health information. One year after DoD eliminates the MCE, commanders must be
aware that, while commanders may still have some health information on their SMs on file, the
decisions about release of PHI primarily starts with providers and SMs. As a consequence,
commanders will less likely to pressure, if not overreach, providers to disclose PHI.
Whether it is training for SMs or commanders, it is worth to underscore that the training
should be ongoing. This means that training should happen at least on a yearly basis. There are
three reasons for this. As a military organization matter, career advancements happen on a
periodical basis. A leader this year may become a commander the year after. As a legal matter,
laws and regulations may demand that training be updated yearly. Finally, as a medical science
matter, advancements in the area may also call for periodical training.
120
See supra Part III.A.1.a).
24
C.
POSSIBLE CONCERNS REGARDING ELIMINATING THE MCE
1.
The Elimination Is Unjustifiable121
Proponents of the MCE may cite to concerns related to national security interests and
interests related to specific military settings, but not all these interests may be applicable.
a)
National Security
As much as national security may be a compelling interest, the interest has been more
chanted as an incantation without much underlying proof. Empirically speaking, no military
commander, leader, or commentator cited an example where lack of commander access to PHI
threatened national security.122
More likely than not, many current DoD safeguards already address issues that could
raise national security concerns. Such safeguards happen at many levels. At the enlistment stage,
a potential SM must meet several screening and clearance requirements. At service stage, there is
the structure of the force. At the provider level, providers, especially uniformed medical staff,
have their duty to offer care that ultimately does not risk national security. At the commander
and leadership level, national security interests are taken seriously.123
b)
Specific Military Settings
While it may be true that in many military settings eliminating MCE may be more
121
One possible concern that eliminating the MCE may raise is that it could be too burdensome
to accommodate to hypersensitive SMs, or, as expressed in tort terms, accommodating to
“eggshell plaintiffs.” Cf. Diane L. Zimmerman, Requiem for a Heavyweight: A Farewell to
Warren and Brandeis’s Privacy Tort, 68 CORNELL L. REV. 291, 341 (1983). Briefly, this concern
may not be completely valid in the military context because of how, in many settings, the privacy
of SMs is reduced. A SM who must spend months in a same barracks as his peers is not likely to
be hypersensitive to privacy.
122
Indeed, some commanders posit that it is unrestricted access to health information that risks
national security. Benjamin, supra note 7, at 25.
123
E.g., Getz, supra note 35, at 15; Rushenberg, supra note 100; Neuhauser, supra note 8, at
1032.
25
beneficial than others, those against the elimination may cite to specific military settings.
Specifically, these are settings where the MCE is the only effective tool that the commanders
may have to help execute military missions. For example, an Army major argues that, in the
Army reserve setting, the lack of human capital and the prevalence of civilian providers make it
very challenging for commanders to ensure compliance with military mission requirements.124
Citing to these reasons may not suffice. These specific settings do not necessarily support
the proposition that the MCE should continue to exist;125 rather, they support that DoD should
create tailored exceptions for commanders and designees. Since the recommendation is that DoD
implement a one-year transition period before eliminating the MCE, commanders still have time
to address the concerns that arise in these specific military settings.
2.
It Is Impracticable to Implement the Elimination
Eliminating the MCE would affect over 1.3 million providers, and thus DoD may
experience implementation issues. DoD may address these issues through focusing on three
research areas, and through acquiring more resources.
a)
Addressing the Concerns Through Research126
First, DoD should expand research in the area of the different interests that affect military
health privacy. DoD’s current test of “proper execution of the military mission” is not very
helpful because it overlooks several interests at issue. What about career choices interests of
SMs? Research interests from collecting accurate data on SMs? What happens to SMs’
124
Getz, supra note 35, at 12–13.
125
Indeed, Getz recommends that the MCE become compulsory. Getz, supra note 35, at 21.
126
Related to the need for research, Tamar Tavory, a major in the Israel Defense Forces,
recommends that revisions to the MCE in the United States take into account different medical
conditions. Tavory, supra note 7, at 240. While such a revision may be sensible, for its
implementation, the revision likely requires DoD policy and legal professionals to partner with
medical counterparts.
26
healthcare interests when they retire and seek care through VA? These three questions are only a
few that DoD’s “proper execution of the military mission” does not answer satisfactorily. These
questions also suggest that there may be interests that could outweigh a military mission. As
such, DoD’s implementation would be more effective if it were to research this further.
Second, DoD must conduct further research in areas related to military health privacy.
While commentators have discussed and alluded to several of these factors, DoD has not
recognized many of them. For example, DoD has yet to recognize that changes to EHR mean
that commanders have more access to SMs’ health information than twelve years ago.
Recognizing this change is important, because, one of the underlying assumptions of the MCE is
that commanders and their designees have uniformly had the same opportunities of access to the
SMs’ health information. As such, if the MCE has been operated under incorrect assumptions, it
may be quite challenging to ensure that eliminating the MCE can be implemented well.
Third, DoD must study further how to best implement the legal consequences of not
complying with privacy laws. As an initial matter, eliminating the MCE means that improper
access of SMs’ health information could risk commanders and providers more liability. From the
part of commanders, they could risk civil liability, especially under the Privacy Act. From the
part of providers, they could be subject to DoD and possibly Office of Civil Rights enforcement
actions. Mainly because of the lack of oversight, the military is currently quite unique in its
actors’ lack of liability risk. DoD should thus further study this matter. Some considerations that
DoD should take into account include the risk that liability could fragment the actors in the
military health system, and could undermine any critical interests.
b)
Areas to Acquire More Resources
Even if eliminating the MCE were not to raise any concerns as a theoretical matter,
27
implementing the elimination in practice would likely to incur costs. DoD may acquire more
resources to overset these costs in two areas. One area may be allocating the resources spent for
implementing electronic records policies. Whether DOD has policies implementing EHR or
broader Virtual Lifetime Electronic Records, one underlying presumption with these records
policies is that they are reliable. Yet, due to many reasons that cause SMs not to seek care, the
reliability of the electronic records is questionable. In effect, DoD aspires to run even before it
can walk. DoD should allocate resources to ensure that it can walk first.
Another area where DoD may acquire more resources is through seeking civilian support.
Many groups, from both sides of the political spectrum, currently support SMs’ interests.127 The
issue related to the MCE, which affect important rights of SMs, should be no exception. If
initiatives such as First Lady Obama’s Joining Forces already focus on emotional, physical, and
financial wellbeing,128 health privacy fits squarely within the focus.
IV.
CONCLUSION
Despite several ongoing and proposed DoD policies affecting SMs, not enough attention
has been paid to the SMs’ health privacy. Specifically, the MCE is a regulation that affects many
of these policies and raises many health privacy issues, but DoD has almost left the MCE
untouched for the past twelve years. This state of affairs is coupled with the fact that
commanders may learn the health information of SMs in other contexts, including screening
forms and under HIPAA’s “treatment” exception.
This Paper proposes a change. DoD should eliminate the exception and focus training on
SMs and commanders. Additionally, for more practical reasons, DoD should conduct further
127
Carmona et al., supra note 80.
128
Joining Forces: Wellness, WHITE HOUSE,
https://www.whitehouse.gov/joiningforces/issues/wellness (last visited Mar. 30, 2015).
28
research and allocate resources for the implementation. Only then, would DoD have drawn the
right line for those facing the line of duty.
29
APPENDIX A: ABBREVIATIONS AND/OR CORRESPONDING EXPLANATIONS
The Paper avoids using too many abbreviations, though abbreviations are common in military
health privacy.129 Below are some common abbreviations present in the regulations and
literature. For the less straightforward abbreviations, I offered a brief explanation.
AHLTA
Armed Forces Health Longitudinal Technology - The DoD electronic health
records system.130
CHAMPUS Civilian Health and Medical Program of the Uniformed Services - The
predecessor of TRICARE.131
DHMSM
Defense Healthcare Management Systems Modernization - DoD’s $11 billion
contract award.132
OEF
Operation Enduring Freedom - The military strikes attacking the groups linked
with the September 11, 2001 terrorist acts.133
OIF
Operation Iraqi Freedom134
OND
Operation New Dawn - An undertaking at the end of OIF transitioning and
rebuilding Iraq.135
VistA
Veterans Health Information Systems and Technology Architecture - The VA
electronic health records system.136
WRAMC
Walter Reed Army Medical Center137
129
Rushenberg, supra note 100.
130
Neuhauser, supra note 8, at 1014.
131
Turley, supra note 111, at 58.
132
Murphy, supra note 3.
133
CNN Library, Operation Enduring Freedom Fast Facts, CNN.COM (Dec. 21, 2014, 2:15 PM),
http://www.cnn.com/2013/10/28/world/operation-enduring-freedom-fast-facts/index.html.
134
Atlanta VA Medical Center, VA.GOV, http://www.atlanta.va.gov/features/OEF_OIF_OND.asp
(last updated Jul. 18, 2014).
135
USI-I, Operation New Dawn, ARMY.MIL (Aug. 31, 2010),
http://www.army.mil/article/44526/Operation_New_Dawn/.
136
PHILLIP LONGMAN, BEST CARE ANYWHERE: WHY VA HEALTH CARE WOULD WORK BETTER
FOR EVERYONE 23 (3d ed. 2012).
137
Examining the Progress of EHR, supra note 2, at 73 (response of Eric K. Shinseki, Secretary
of U.S. Department of Veterans Affairs).
30