Managing Employee Medical Records in the Workplace
Understand how federal privacy rules, disability laws, and best practices govern the way employers collect, store, and share employee medical information.
Employee health information is increasingly present in the workplace, from disability accommodations and leave requests to wellness programs and workers’ compensation claims. Understanding how employee medical records must be handled is critical for employers, HR professionals, and employees who want to protect privacy while staying compliant with the law.
Why Workplace Medical Records Are Legally Sensitive
Unlike routine personnel data, medical records include details about diagnoses, treatment, disabilities, and functional limitations. Mishandling this information can trigger legal liability under federal laws such as the Americans with Disabilities Act (ADA), the Family and Medical Leave Act (FMLA), and, in some situations, the Health Insurance Portability and Accountability Act (HIPAA)
These laws are designed to:
- Protect workers from discrimination based on health or disability status.
- Limit who may access health information and when it may be requested.
- Require employers and health plans to maintain confidentiality and security.
- Provide clear rules for disclosures for safety, emergency care, and legal compliance.
Key Legal Frameworks Governing Workplace Medical Information
Multiple federal laws intersect when employers collect or store medical information. Each addresses different aspects of the employment relationship.
Americans with Disabilities Act (ADA)
The ADA restricts how employers may request, use, and disclose medical information before and after hire. The law applies to employers with 15 or more employees.
- Pre-offer stage: Employers generally may not ask job applicants about disabilities, medical conditions, or past workers’ compensation claims. They may only ask if the applicant can perform essential job functions.
- Post-offer but pre-employment: After making a conditional offer, employers may require medical exams or questionnaires, but only if all applicants in the same job category are treated the same and the information is kept confidential.
- After employment begins: Any medical inquiries must be job-related and consistent with business necessity, such as verifying ability to perform duties or assessing safety risks.
- Confidentiality rule: Medical information must be stored separately from personnel files, with access limited to people who have a legitimate need to know.
Family and Medical Leave Act (FMLA)
When employees request FMLA leave for serious health conditions, employers may obtain medical certifications but must limit requests to information needed to verify the nature of the condition and the need for leave.
- Use standardized government forms when possible, rather than open-ended requests.
- Store FMLA medical certifications in confidential medical files, not general personnel records.
HIPAA and Employment Context
HIPAA’s Privacy Rule primarily governs covered entities such as health plans and health care providers, not most employers.
| Setting | How HIPAA Applies |
|---|---|
| Medical/clinical setting | Health care providers and plans must protect “protected health information” (PHI) and limit disclosures to authorized purposes. |
| Employer workplace | HIPAA usually does not apply to employer personnel records. HIPAA applies when health plans or providers share PHI, not to employer questions or standard HR files. |
| Employer-sponsored health plan | The plan administrator must comply with HIPAA. If PHI is transferred to the employer, strict rules govern what can be shared and for what purpose. |
HIPAA does, however, limit when health care providers may disclose employees’ medical information directly to an employer. In general, providers need the employee’s authorization, unless another law specifically requires release.
What Counts as an Employee Medical Record?
“Employee medical record” is a broad concept encompassing any workplace-held information about an employee’s physical or mental health. It is not limited to formal medical charts.
Typical contents include:
- Pre-placement or post-offer medical exam results.
- Documentation of disabilities and accommodation requests.
- FMLA medical certifications and related doctor’s statements.
- Workers’ compensation reports regarding work-related injuries.
- Records maintained by occupational health clinics serving the workforce.
- Notes from fitness-for-duty or return-to-work evaluations.
- Information collected through voluntary wellness programs, if tied to identifiable employees.
Regardless of form, if the information is identifiable and describes health status, it should be treated as a medical record for privacy and confidentiality purposes.
Confidentiality and Access Rules Inside the Employer
Once an employer possesses employee medical information, confidentiality requirements become crucial. ADA guidance and occupational health standards consistently emphasize limited access and segregation of files.
Separate Storage From Personnel Files
Medical records should be kept in dedicated, secure files—physical or electronic—separate from standard personnel data such as performance reviews or disciplinary actions.
- Use locked cabinets or secure digital folders with restricted permissions.
- Clearly label medical records to avoid accidental disclosure during routine file access.
- Restrict access to HR, occupational health, or compliance personnel who have a defined need.
Who May See Employee Medical Information?
Under ADA-based confidentiality rules, only certain internal recipients may access medical information, and only for specific purposes.
- Supervisors and managers: May be told about work restrictions and necessary accommodations but not broader diagnostic details.
- First aid and safety personnel: May be informed when knowledge of a condition is needed for emergency response or special medical treatment.
- Government officials: May receive relevant information when investigating compliance with disability, safety, or employment laws.
Outside these categories, broad sharing of medical information with co-workers or other departments is generally prohibited.
When Employers May Request or Receive Medical Information
Employers may sometimes need medical information to administer leave, evaluate safety risks, or confirm ability to perform essential job duties. However, requests must be limited and justified.
Employer Requests to Employees
Employers may ask employees directly for health information in certain contexts, for example:
- Verifying eligibility for sick leave or disability benefits.
- Obtaining documentation for FMLA or similar statutory leave.
- Supporting workers’ compensation or insurance claims.
- Assessing the need for reasonable accommodations under the ADA.
These requests must be:
- Limited to job-related information or the purpose at hand.
- Not overly broad or intrusive into unrelated medical history.
- Handled with the same confidentiality protections as other medical records.
Employer Requests to Health Care Providers
When employers seek information directly from health care providers, HIPAA rules apply to the provider’s response.
- In general, providers cannot release PHI to an employer without the employee’s written authorization, except in limited circumstances required by law.
- Occupational health providers may disclose certain information to employers to evaluate work-related illness or injury or conduct workplace medical surveillance, but must follow HIPAA’s conditions and minimize the data disclosed.
- Even when legally permitted, providers should disclose only the minimum necessary information to fulfill the purpose of the request.
Workplace Wellness Programs, Testing, and Surveillance
Workplaces increasingly use wellness programs, fitness assessments, and periodic medical testing. These activities raise privacy questions when connected to employment decisions.
Voluntary Wellness Programs
Wellness initiatives are common, but they must be structured to avoid coercion or misuse of medical data.
- Programs should be clearly voluntary, with no penalty for non-participation.
- Medical information collected should be confidential and not used for hiring, promotion, or disciplinary decisions.
- Where possible, use aggregate, de-identified data for organizational health analysis, rather than individual records.
Periodic Medical Testing
Periodic medical testing may be appropriate for safety-sensitive positions, such as emergency responders or long-haul truck drivers, when required by law or critical for public safety.
- Testing must be job-related and consistent with business necessity.
- Test results are medical records and must be protected like other health information.
Best Practices for Employers Handling Medical Records
Beyond basic legal compliance, employers can reduce risk and build trust by adopting robust policies and controls for medical records.
Core Compliance Practices
- Limit collection: Request medical information only when necessary for a defined business or legal purpose.
- Use standardized forms: Rely on official government forms (such as FMLA certifications) or narrowly tailored questionnaires.
- Segregate records: Maintain medical files separate from personnel records, with restricted access controls.
- Train staff: Educate HR and managers about confidentiality rules, permissible disclosures, and documentation requirements.
- Review retention laws: Ensure medical records are retained and destroyed according to applicable federal, state, and local laws.
Policy Elements to Include
Written workplace policies should clearly explain how medical information is handled. Consider including:
- A definition of what constitutes medical information in your organization.
- Procedures for requesting documentation for leave, accommodation, and fitness-for-duty evaluations.
- Rules for supervisors on what they may ask and what they may not ask about health conditions.
- Incident response steps if a breach of confidential medical information occurs.
Employee Rights and Employer Obligations
Employees should understand their rights, and employers should be clear about their obligations when medical information is involved.
Employee Rights
- To be free from discrimination based on disability or health status under the ADA.
- To have medical information collected by the employer kept confidential, with limited access.
- To authorize, or decline to authorize, certain releases of medical information by health care providers to the employer, subject to legal exceptions.
- To receive information about data breaches affecting their health records under applicable state privacy laws.
Employer Obligations
- Comply with ADA restrictions on medical inquiries and maintain confidentiality of disability-related information.
- Use medical information only for legitimate purposes, such as accommodations, safety, or legal compliance.
- Cooperate with government investigations by providing relevant medical information when required, while still limiting unnecessary disclosure.
- Ensure that occupational health providers who serve employees understand and follow HIPAA rules when sharing information with the employer.
Frequently Asked Questions About Workplace Medical Records
Can my employer see my full medical diagnosis?
Generally, employers should receive only the information needed to determine work restrictions, leave eligibility, or accommodations, not full diagnostic details. Supervisors typically learn about limitations (for example, lifting restrictions), rather than underlying conditions.
Does HIPAA protect my personnel file?
HIPAA does not protect employer personnel records, even if they contain health-related information. The Privacy Rule governs disclosures by health plans and health care providers, not routine HR records. Other laws, like the ADA, provide confidentiality protections for health information in employment files.
Can my employer ask for a doctor’s note?
Yes. Employers may ask for documentation when you request sick leave, FMLA leave, or disability accommodations. However, they may only request information relevant to the work-related purpose and must store it in confidential medical files.
Who in the company can access my medical records?
Access is limited. Typically, HR or occupational health staff manage the records, and supervisors are informed only of necessary work restrictions and accommodations. Safety personnel may be told about medical conditions that affect emergency response.
Can my doctor send my medical information directly to my employer?
In most cases, your doctor needs your written authorization to send medical information directly to your employer, unless another law requires disclosure. Occupational health providers may have additional authority to share limited information for workplace surveillance or evaluation of work-related illness or injury, but they still must meet HIPAA requirements and minimize the data disclosed.
References
- Employers and Health Information in the Workplace — U.S. Department of Health and Human Services (HHS). 2013-09-19. https://www.hhs.gov/hipaa/for-individuals/employers-health-information-workplace/index.html
- An Employer’s Legal Compliance Guide to Handling Employee Medical Information — Venable LLP. 2025-06-10. https://www.venable.com/insights/publications/2025/06/an-employers-legal-compliance-guide-to-hand
- Medical Records — Alden Law Group, PLLC. 2024-02-01. https://www.employmentlawfederal.com/practice-areas/privacy/medical-records/
- The Privacy and Security of Occupational Health Records — American Health Information Management Association (AHIMA). 2005-03-01. https://journal.ahima.org/Portals/0/archives/AHIMA%20files/The%20Privacy%20and%20Security%20of%20Occupational%20Health%20Records.pdf
- Medical Privacy Laws Every Employer Should Know — Q Staffing. 2021-08-15. https://www.q-staffing.com/blog/employer-medical-privacy-laws/
- Massachusetts Law About Medical Privacy — Commonwealth of Massachusetts. 2023-05-12. https://www.mass.gov/info-details/massachusetts-law-about-medical-privacy
- Understanding HIPAA in the Workplace vs. the Medical Setting — 501(c) Services. 2022-07-19. https://501c.com/hipaa-workplace-vs-medical/
Similar Articles
Read full bio of Sneha Tete
