“Bryon’s HIPAA Amendment” Could Help Locate Missing People or Extend Their Timeline.

HIPAA has served as a cornerstone of patient privacy in the United States, and I support its protections fully. However, in certain urgent disappearance cases — especially those involving mental health crises, cognitive impairment, disorientation, or homelessness — the inability to verify presence at medical facilities or institutions can prevent life-saving interventions or deny closure to families of the missing individuals.

This amendment does not seek to override privacy for curiosity or control. Rather, it would allow trusted parties (law enforcement, verified next-of-kin, or approved missing person advocates) to access only limited, non-clinical identifying information (dates, locations, facility names) under judicial oversight and confidentiality safeguards.

Because missing person investigations are extremely time-sensitive, many cases go cold within days or weeks. Granting this limited access can shed light on the last known points in a person’s itinerary, extend the paper trail, and in many instances bring someone home or provide long-sought closure.

I respectfully request that HHS consider this submission as a public petition for rulemaking under the Administrative Procedure Act (5 U.S.C. §553(e)), and either:
• Publish a Notice of Proposed Rulemaking (NPRM) adding this new disclosure exception in 45 CFR §164.512; or
• Undertake initial review and stakeholder consultation to initiate the change.



I am proposing a federal-level HIPAA amendment. This means I am proposing to modify the HIPAA Privacy Rule itself (45 CFR §164.512) — the section that already governs when protected health information (PHI) may be disclosed without patient authorization (for example, for law enforcement, emergencies, or public health reasons).

The goal will be to add a new subsection under that rule — something like “§164.512(n): Disclosure for Missing Persons Location and Welfare Determination.”


Proposed Federal HIPAA Amendment:
Bryon’s HIPAA Amendment for Missing and Endangered Persons

Purpose:
To amend the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR §164.512) to permit limited and confidential disclosure of medical, psychiatric, and related institutional records when such information is reasonably necessary to assist in the location, identification, or welfare verification of a reported missing person.

This amendment seeks to balance the privacy rights of individuals with the urgent, life-safety interests of families, law enforcement, and public welfare agencies engaged in locating missing or endangered individuals.

Background and Need:
Under the current HIPAA Privacy Rule, hospitals, psychiatric facilities, transitional homes, and other covered entities are prohibited from disclosing protected health information (PHI) without written consent, except in narrowly defined circumstances such as emergencies, some law enforcement investigations, or public health events.
This strict interpretation, while essential for protecting privacy, unintentionally obstructs life-saving efforts in missing person cases. Law enforcement and family advocates routinely encounter situations where an individual may be hospitalized, disoriented, or even deceased, yet facilities refuse to confirm or deny their presence due to HIPAA restrictions. In some “exception” cases, the current HIPAA laws can actually do more harm than good.

The proposed amendment addresses this gap by creating a narrowly tailored exception (similar in spirit to existing “law enforcement,” “decedent,” and “public health” exceptions) designed specifically for missing or endangered persons.

This amendment is named after Bryon Arthur Gravel, a man who went missing in 2006 in Florida. He was known to have visited psychiatric hospitals, emergency rooms, and transitional housing, yet even law enforcement was not authorized to obtain his records. I have been helping advocate for his case and researching his case for a few years now, and there is no evidence that he went missing voluntarily. In fact, there has been no proof that he is still alive. His family has been searching for him for years. His parents desperately want to know his whereabouts. His friends have stated numerous times that he was in and out psychiatric facilities, yet due to HIPAA laws, his records cannot be accessed. This is a very familiar story amongst many missing people, especially missing men who have been diagnosed with mental illness or drug abuse. Many of them fall into cracks in the system. I would love to help extend Bryon’s timeline and other missing people’s timelines, in hopes of it bringing forth clues. I believe that this amendment would help thousands of missing person cases and to bring closure to their loved ones – or at least a glimmer of hope. This amendment alone may help directly locate some missing people, but in other cases, it may simply extend their timeline. This is extremely important, as it can bring clues to the last known geographical location, the last known date of being seen, etc.

Section 1. Amendment to 45 CFR §164.512
Add a new subsection (n): Disclosure for Missing Persons Location and Welfare Determination.
§164.512(n): Missing Persons Exception
1. Permissible Disclosures.
A covered entity may disclose limited identifying information to assist in locating, identifying, or verifying the welfare or survival status of a person who has been reported missing, provided that:
o The request originates from any of the following:
• A law enforcement officer who oversees and provides an active missing person case number; or
• A verified next-of-kin (parent, spouse, adult child, or sibling); or
• A friend, neighbor, or concerned citizen, if approved by judicial review, especially if no next-of-kin is known (or even if the next-of-kin are not able or willing to participate in obtaining records); or
• A court-appointed guardian, conservator, or missing person advocate approved by judicial order.
• If no next of kin exists or can be reached or is not invested in the search (or physically/mentally able to be engaged), a swift court hearing can take place in less than 2 weeks online to allow a close contact or missing person advocate who has the best interest of the missing person at heart.
• A swift court hearing will take place in less than 2 weeks online to allow a close contact or missing person advocate who has the best interest of the missing person at heart, regardless of whom the requester is.


2. Scope of Disclosable Information.
The following categories of information may be disclosed solely for the purpose of confirming location, identification, or survival of the missing person:
o Dates and locations of hospital admissions, discharges, or transfers
o Facility name(s) and city/state of treatment or residence (including transitional homes, homeless shelters, Oxford homes, rehabilitation centers, and any other facility or residence)
o Date and location of medical encounters, emergency transport, or shelter intake
o Records of psychiatric inpatient or outpatient treatment (limited to facility identifiers and dates only)
o Group home, rehab, detox, or transitional housing intake and discharge logs
o Probate filings, guardianship or conservatorship documentation confirming legal supervision
o EMS or emergency response transport logs
o Date and time of death and death-certificate jurisdiction (if applicable)
* No clinical notes, diagnoses, medications, psychotherapy notes, or treatment details may be disclosed under this section unless further authorized under subsection (n)(5). In some cases, if it is considered helpful to have the clinical notes, diagnoses, medications, and treatment details, the requester can gain a second swift online court hearing.
*I am proposing an online court hearing simple because many missing people have records in a distant location from their loved ones or people who are searching for them.
3. Conditions for Disclosure.

Disclosures under this subsection are permitted only when:
o The individual has been officially reported missing to a law enforcement agency, and
o There is no evidence that the individual intentionally disappeared with informed, sound-mind consent.

4. Judicial or Administrative Oversight.
If a covered entity is uncertain about the appropriateness of a disclosure, it may require a court order or judicial authorization. Courts shall ensure expedited review for such requests, recognizing the time-sensitive nature of missing person cases. This review should be able to take place online, if possible, as loved ones of the missing could be scattered in different areas, and it should take place within two weeks of the request (ideally within 48 hours). A decision should be granted immediately or within two business days of the review.

5. Extended Disclosures After Three Years.
If the individual remains missing for more than three years after the initial report, additional limited disclosures may be made to assist ongoing identification efforts, including:
a. Relevant medical conditions that could affect recognition, mobility, or safety (e.g., diabetes, seizure disorder, mental illness, mobility impairment)
b. Photographs or identifying medical descriptions (e.g., scars, tattoos, prosthetics, surgical implants)
6. Safeguards and Restrictions.
a. All disclosures must be limited to the minimum information necessary.
b. Disclosures must be documented in the individual’s record, including the date, purpose, recipient, and authority authorizing the release.
c. Recipients of information under this section may not publish or distribute the data beyond the investigative or familial purpose.
d. Unauthorized secondary disclosure or misuse of information shall be subject to civil penalties under HIPAA §1177.
7. Good-Faith Protections for Entities.
Covered entities making disclosures in good faith reliance on this subsection shall not be held liable for damages or penalties if the disclosure was made in accordance with these requirements.
8. Coordination with Law Enforcement and National Databases.
Covered entities from the court are encouraged to maintain liaison procedures with the National Missing and Unidentified Persons System (NamUs) and relevant law enforcement agencies to facilitate lawful and secure verification of patient/resident status.

Section 2. Definitions
For the purposes of this subsection:
• Missing Person means an individual whose whereabouts are unknown to a family member, guardian, or law enforcement agency, and who is reasonably believed to be lost, endangered, or disoriented. If loved ones of the missing person are deceased, incapacitated, lost, or unable or unwilling to partake in this endeavor, a missing person advocate will also be able to obtain records (only if approved by judicial review at a court hearing).
• Covered Entity retains the meaning assigned under 45 CFR §160.103.
• Authorized Requestor means a law enforcement officer, verified next-of-kin, or judicially approved advocate as defined above.
• Limited Identifying Information means non-clinical data sufficient to confirm an individual’s location, welfare status, or identity.

Section 3. Legislative Intent
This amendment affirms that privacy law must not serve as a barrier to safety or family reunification. Its intent is to protect individuals who are lost, disoriented, or endangered—without compromising the privacy of those who deliberately choose separation.
HIPAA’s mission to safeguard dignity must extend to protecting life itself.

Section 4. Implementation and Oversight
• The Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR), shall issue implementing guidance within 180 days of enactment.
• Covered entities shall update compliance manuals and training materials accordingly.
• Annual review of cases utilizing this provision shall be conducted to ensure continued balance between privacy and safety.

Section 5. Short Title
This amendment may be cited as the
“Bryon’s HIPAA Amendment for Missing and Endangered Persons.”



Explanatory Note: Why This HIPAA Amendment Is Urgently Needed

The Health Insurance Portability and Accountability Act (HIPAA) was established to protect patients’ privacy, dignity, and autonomy. It remains one of the most important privacy frameworks in American history, ensuring that sensitive medical information is never misused or disclosed without authorization. This proposal fully supports that intent.

However, the same protections that safeguard privacy can, in certain rare but critical circumstances, endanger the very people they were meant to protect. Missing persons cases—especially those involving individuals who are mentally ill, cognitively impaired, or otherwise vulnerable—expose a devastating gap in the current law. When a missing individual is hospitalized, in psychiatric care, or residing in a transitional facility, HIPAA restrictions often prevent even the most basic verification of their welfare or location. Families, advocates, and law enforcement are left in the dark, sometimes for months or years, while their loved one may be in danger—or deceased—unidentified.

This amendment does not seek to weaken HIPAA. It seeks to refine it—to add a humane, case-specific exception where privacy protections are doing more harm than good. The amendment introduces a narrowly defined process allowing the release of limited, non-clinical identifying data (such as admission or discharge dates, facility names, or city locations) solely for the purpose of locating or verifying the safety of a missing person.

• Some missing people are not missing voluntarily. They may be disoriented, psychotic, exploited, or gravely ill. They cannot exercise informed consent or self-advocacy, and their lives may depend on being found quickly.
• Others are missing voluntarily and with sound mind. In these cases, privacy must remain fully protected. The amendment addresses this distinction through judicial discretion and case classification safeguards.

Under this proposal:
• Once a person is officially classified as “involuntarily missing”—for example, by law enforcement, a court, or a certified case manager—specific medical and institutional records would be temporarily unlocked for limited review by authorized personnel.
• Each case would undergo judicial review to determine whether the person requesting records of the missing person has an intent of good faith and that the lift of the HIPAA law will benefit the missing person more than harm the missing person.
• If there is clear evidence that a missing adult intentionally chose to disappear and is of sound mind, their records remain sealed under HIPAA for 5 years. If the missing person went missing as a child but has now aged 18+, records will be open. If a person became estranged from loved ones, this will not be categorized s “missing voluntarily” and will be treated on a case-by-case basis.
• In all cases, expedited access would be required—ideally within 48 hours but no later than two weeks—because missing person investigations are time-sensitive by nature. Every day of delay can mean the difference between life and death, between finding someone alive or never finding them at all.



**Many People Go Missing After a Hospital Stay.**

Unsafe Hospital / Alternative Housing Discharge:
In our current mental health and medical infrastructure, discharges are treated as administrative endings. But in reality, for many vulnerable individuals, discharge is the beginning of a new and dangerous spiral.
It’s a tragically common pattern:
• A person is admitted to a psychiatric unit, detox center, rehab, or group home, or simply gets taken to the ER for medical or cognitive issue.
• They are oftentimes discharged with no working phone, no ID, no place to go, and often, no one waiting for them.
• Some people who do not drive are offered a bus pass or a ride, but that is not the norm. Oftentimes, they are discharged with lack of a safe plan. Many are even sent out of the facility by foot in a state of confusion or disorientation.
• Within hours (or even sometimes minutes), they vanish.
They become missing persons, sometimes never seen again.
And yet, no formal tracking system exists for what happens post-discharge. Even law enforcement has a difficult time obtaining records, when a family is consumed by misery for years on end, only to find out their loved one’s fate years later, when the clues were there all along.

The Critical Gap: “Voluntary” Exits from Facilities
Many facilities allow residents or patients to leave against medical advice (AMA) or voluntarily exit group homes. While this supports civil liberties in theory, in practice it often means:
• A disoriented individual walks out the door with no supervision.
• No call is made to family, case managers, or police.
• The person, still in crisis, walks into traffic, relapses, or becomes prey to street violence or exploitation.
This is especially common in:
• Psychiatric hospitals
• Oxford-style sober living homes
• Public detox centers
• Private rehab facilities
• Mental health halfway houses

This proposed amendment aims to allow more care to be taken place after people become missing amidst the shuffle of the medical world, psychiatric centers, alternative housing, and so forth.

Having solved hundreds of missing person cases myself, I can share that I have first-hand insight as to just how many people go missing after a hospital discharge, sober living home discharge (or voluntary leave), detox center, emergency room visit, etc. That is why I have created this amendment. Bryon Arthur Gravel is a missing person after whom this amendment is named. He went missing after having many hospital visits, and the last time anyone heard from him, he was in and out of the hospital. Having his records would likely extend his timeline and solidify his whereabouts when he was last seen. He was living a homeless / transient lifestyle, and many people who are homeless / transient go missing because they get lost in the shuffle. They are still important and still are human beings who deserve to be found. They oftentimes go missing as a direct or indirect result of their vulnerability. In many of these cases, having these types of records will help tremendously. Bryon’s family has been searching for him relentlessly, and they deserve to know what happened to him, especially considering there is no evidence of life at this point. HIPAA serves to protect people, which is an astounding function; however, in many missing person cases, it can hurt more than it can help. There is a gray area where we want to protect people’s privacy, but we don’t want to over-protect to the point in which now the missing person remains a cold case mystery for decades on end. I aim to put an end to this cycle.

I have seen the need for such an amendment for many years, but I am finally setting forth this proposal in hopes that I can be a voice for the missing. Also, many people who did not necessarily go missing directly following a medical facility / transitional housing release will benefit from having records opened to someone who is searching for them, as these records can provide clues and extend their timeline.


This proposed amendment reflects a simple but vital principle: privacy should never become a barrier to safety. It ensures that HIPAA continues to protect personal dignity, while allowing measured, compassionate flexibility in cases where immediate intervention can prevent tragedy or provide long-overdue closure for families.

By permitting this exception, we acknowledge that protecting a person’s life and well-being is the highest form of honoring their privacy.