French investigators have called for medical confidentiality to be relaxed for pilots, in the wake of last year's Germanwings disaster.
Co-pilot Andreas Lubitz was urged by a doctor to attend psychiatric hospital weeks before he crashed the plane on 24 March 2015, but his employer was never alerted, their final report says.
All 150 people on board died as Flight 9525 hit a mountain in the French Alps.
Investigators believe Lubitz brought down the plane deliberately.
He had been suffering from severe depression, they said, but doctors had been unable to disclose this.
The report, by the BEA investigation agency, said confidentiality had to be balanced with the risk an individual might pose to public safety and that "clearer rules" were needed.
It was also critical of pilots being able to make self-declarations about their health, which allowed them to hide any illnesses.
A union representing German pilots welcomed the recommendations as a "balanced package of measures", but it said strict rules on data protection needed to be developed in conjunction with criteria for suspending confidentiality rules.
Correspondents say privacy is a highly sensitive issue in Germany, a country which has in the past seen extensive state surveillance, most recently under the Communist regime in the east.
The report points out that strict German laws on protecting confidentiality are balanced by provisions protecting anyone who acts to prevent an immediate danger.
Countries including Canada, Israel and Norway have specific laws on confidentiality for pilots.
Lubitz's medical visits in weeks leading up to crash
- 17 February: Doctor issues eight-day sick note not forwarded to Germanwings; second doctor refers Lubitz to psychotherapist and psychiatrist for outpatient treatment of psychosomatic disorder and anxiety disorder
- 22 February: Second doctor issues sick note for three days
- 9 March: Third doctor issues sick note, end date unknown, not forwarded to Germanwings
- 10 March: Second doctor refers Lubitz for psychiatric hospital treatment due to possible psychosis
- 12 March: Second doctor issues sick note for 19 days, not forwarded to Germanwings
- 18 March: Fourth doctor issues sick note for five days
The head of the BEA investigation, Arnaud Desjardin, said Lubitz had in December 2014 begun to show symptoms that "could be compatible with a psychotic episode" but this information was not passed on to Germanwings.
The report also calls for more stringent medical checks for pilots - it recommends regular analysis to check for "psychological or psychiatric problems".
But it has not suggested any change to cockpit rules. Lubitz was able to lock the pilot out of the cockpit while he crashed the plane, taking advantage of a system designed to prevent hijackings by attackers elsewhere on board.
"A lockage system cannot be created to prevent threats coming from both outside and inside the cockpit," Mr Desjardin said.
Many airlines now require at least two people to be in the cockpit at any given time.
Both Germanwings and its parent company Lufthansa have previously said that Lubitz, 27, had passed all tests of fitness to fly.
Lufthansa has also acknowledged that it knew the co-pilot had suffered from severe depression in 2009 while training for his pilot's licence.
- 1. 09:30 - The plane makes final contact with air traffic control
- 2. 9:30:55 - Autopilot is manually changed from 38,000ft to 100ft
- 3. 9:31 - The aircraft begins its descent above the French coast
- 4. From 09:33 - Air traffic controllers try to contact the pilots, with no response
- 5. 09:40:47 - Last radar position of the plane registered at 6,175ft, just 2,000ft above ground
- 6 09:41:06 - Cockpit recording ends at the moment of collision