Pilots would lose privacy protection for health records and airlines would need insurance when the employees lose their license under a proposal from the French air-safety agency that investigated the deliberate crash of a Germanwings passenger jet into a mountainside.

Authorities should re-examine how pilot health is monitored and assessed, and consider forcing medical practitioners to share any concerns with airlines in instances where the safety of passengers is highly at risk, BEA, France’s air accident investigator, said in the study published Sunday. The Germanwings crash killed 150 people.

The report confirmed that pilot Andreas Lubitz flew the Airbus Group SE A320 into the ground after locking his captain out of the cockpit during a toilet break. After the crash on March 24, 2015, it was revealed that Lubitz was suffering from psychological problems that weren’t fully apparent to his employer because of privacy laws designed to encourage people to consult doctors without fear for their jobs.

Rules should be defined to “require health-care providers to inform appropriate authorities when a patient’s health is very likely to impact public safety, while still protecting patients’ private data from unnecessary disclosure,” BEA said in a statement distributed in Le Bourget, near Paris.

Privacy laws kept authorities and the airline in the dark about Lubitz’s condition, even as he was diagnosed with psychotic depression four months before the crash and was recommended for psychiatric hospital treatment two weeks before the fatal flight, BEA said in its statement. It was impossible for authorities to prevent Lubitz from flying, it said.

Lubitz hid his illness from his employer, it said. BEA recommended steps to “mitigate the socio-economic risks related to pilots’ loss of license for medical reasons.”

Nuclear, Railway

Airlines follow the French nuclear and railway industries, which have to some extent resolved the issues with license-loss insurance, BNA head Remi Jouty said.

Some airlines have already taken such steps, he said, adding that they “allow pilots to be paid even if they are declared unfit to fly.”

The biggest pilots’ union in France doesn’t support the change on medical confidentiality, while a German union said the recommendations could make a similar disaster less likely in the future.

‘Too Flexible’

“If medical confidentiality becomes too flexible, if a pilot can loose his job and see his medical secrets become public, some pilots won’t seek treatment,” Yves Deshayes, the vice-president of France’s largest pilot union, said by telephone.

The proposed insurance system wouldn’t encourage pilots to disclose their mental conditions, he said, because only a few years of salary would be covered, not an entire career. The union advocates for a better follow-up on pilots’ health and a system that would let pilots with psychological issues disclose their conditions to colleagues first, Deshayes said.

“The safety recommendations of the accident investigation authority form a balanced package of measures to make such a disaster less likely in the future,” Markus Wahl, press spokesman for Germany’s Vereinigung Cockpit pilots’ union, said in a statement.

Even so, medical confidentiality is a fundamental good and must be protected, he said, calling for strict data protection standards to be applied when creating a set of criteria that specifies which illness must be reported.

Psychological Tests

BEA also recommended closer medical monitoring of pilots “with an identified history of mental illness.” However it ruled out in-depth psychological testing of all pilots to detect serious mental illness, saying it would be “neither productive nor cost effective.”

The investigative office had already provided a minute-by-minute analysis of the crash in an interim report in May. The plane’s black boxes showed that the captain left the cockpit as the jet bound for Dusseldorf from Barcelona reached a cruising height of 38,000 feet; once alone, Lubitz changed the selected altitude to 100 feet — well below the mountainous terrain ahead.

During a “continuous and controlled descent” spanning 10 minutes, ground controllers failed to contact the plane in 11 attempts on three frequencies. The French military also failed to get through, as did the crew of another aircraft.

The captain was outside the cockpit for more than four minutes before seeking readmission. When Lubitz failed to open the door he sought four times to contact him using an intercom system, before resorting to “violent blows” as the situation became desperate.

In the cockpit, the voice recorder revealed sounds of controlled and steady breathing until a few seconds before impact.

The mandating of impenetrable cockpit doors after the Sept. 11, 2001, attacks on New York and Washington meant it was impossible for anyone to intervene and stop Lubitz even when his intentions became apparent.

The BEA doesn’t question the rule about locking the cockpit door as it protects against intrusions, Jouty told reporters.

The French union doesn’t support a modification of the rule either, Deshayes said.