The duty to disclose medical information to an employer is nuanced. Employees do not have to reveal every health detail, but certain circumstances—such as requesting reasonable accommodations, leave under the Family and Medical Leave Act (FMLA), or reporting a condition affecting safety—may require disclosure. This article explains when disclosure is required, what information is protected, and how to protect privacy while complying with workplace requirements under U.S. law.
What Medical Information Employers Can Access
Under federal law, medical information is highly protected. Employers generally may access health information only if it is directly relevant to a work-related need. Examples include verifying an employee’s eligibility for FMLA leave, determining reasonable accommodations for a disability, or assessing fitness for duty in safety-sensitive roles. Access is typically limited to human resources personnel and supervisors who need the information to administer leave, accommodations, or safety programs.
Key Laws That Shape Disclosure and Privacy
Several laws govern disclosure and privacy of medical information in the U.S.:
- Americans with Disabilities Act (ADA): Prohibits discrimination based on disability and requires confidentiality of medical information. Employers may request medical documentation only to support a request for reasonable accommodations or to determine essential job functions.
- Family and Medical Leave Act (FMLA): Allows eligible employees to take unpaid, job-protected leave for medical reasons. Employers may require medical certification to substantiate the need for leave, and the information collected is treated as confidential.
- Health Insurance Portability and Accountability Act (HIPAA): Protects health information when handled by covered entities and business associates. In many workplaces, HIPAA restrictions are enforced through the employer’s health plan and medical providers, reinforcing privacy standards for medical data.
- Occupational Safety and Health Administration (OSHA): Requires certain disclosures for safety-related reasons but does not override general privacy protections for medical information.
What You May Be Required To Disclose
Typical situations that may necessitate medical disclosure include:
- Leave Requests: For FMLA or state family leave, documentation from a healthcare provider may be required to certify the need for leave and expected duration.
- Workplace Accommodations: To request an accommodation for a disability, documentation describing the functional limitations and needed accommodations is often required.
- Fitness for Duty: In safety-sensitive roles, employers may require certification that an employee can perform essential job duties without endangering themselves or others.
When disclosing, provide only information relevant to the need for leave or accommodation. Avoid sharing unrelated health details in ordinary communications unless specifically requested.
What You Should Not Have To Share
Employees generally should not disclose their entire medical history or unrelated conditions. Personal health information not connected to the reason for disclosure should remain private. Employers should not request access to general medical records or health data beyond what is necessary to administer leave, accommodations, or safety programs.
How Medical Information Should Be Protected
Best practices for privacy include:
- Confidential Storage: Medical information should be stored separately from personnel files in a secure, access-controlled location.
- Controlled Access: Only personnel who need the information should have access. Managers should not view medical details beyond what is necessary for accommodations or safety decisions.
- Documentation Protocols: Use standardized forms to collect medical certification, keep records for the legally required duration, and note who has accessed them.
- Data Minimization: Share only the minimum necessary information and redact sensitive details when possible.
Practical Steps for Employees
To navigate disclosure confidently, consider these steps:
- Know Your Rights: Familiarize yourself with ADA and FMLA rights, and understand how your employer handles medical information.
- Document Requests: Keep copies of all medical certifications and communications related to leave or accommodations.
- Communicate Through HR: Submit medical documentation to Human Resources and request that it be kept confidential, explaining the reason for disclosure.
- Ask for Clarification: If a request seems overly broad, ask HR to specify what information is needed and why.
- Seek Legal Advice: If you feel your privacy rights are violated, consult an employment attorney or a relevant labor agency.
Practical Steps for Employers
Employers should balance operational needs with employee privacy:
- Establish Clear Policies: Create transparent procedures for requesting medical information, certifications, and accommodations, outlining who may access data and how it is stored.
- Limit Data Access: Grant access on a need-to-know basis and maintain separate medical files.
- Provide Training: Educate managers and HR staff on privacy laws, discrimination protections, and appropriate handling of medical information.
- Offer Alternatives: Use written certifications and de-identified data when possible to minimize exposure of sensitive information.
Common Scenarios and Guidance
These scenarios illustrate typical disclosure questions and recommended approaches:
- Employee requests extended medical leave: Obtain medical certification to document the need and anticipated duration; keep information confidential and only share with eligible parties.
- Employee needs an accommodation for a disability: Request a description of functional limitations and proposed accommodations; avoid unnecessary medical details and protect privacy.
- Safety concerns in a critical role: If health issues could affect safety, request appropriate certifications while maintaining confidentiality of unrelated records.
Resources and Contact Points
For authoritative guidance, consider these resources:
- Equal Employment Opportunity Commission (EEOC) – ADA and privacy provisions
- U.S. Department of Labor – FMLA guidance and employer responsibilities
- Office for Civil Rights (HIPAA privacy rules) for health information handling
- State employment offices or labor boards for state-specific privacy and accommodation rules