Can My Employer Share My Medical Information?
Federal employment rules can require medical information to stay confidential while allowing narrow disclosures for accommodations, safety, and compliance.
Can My Employer Share My Medical Information?
Sometimes, but not freely. When the Americans with Disabilities Act applies, medical information an employer obtains about an applicant or employee generally must be treated as a confidential medical record. Narrow disclosures may be allowed for work restrictions, accommodations, emergency assistance, government compliance, workers' compensation, or insurance. The source of the information, employer coverage, reason for sharing, recipient, and amount disclosed can all affect the analysis.
Medical Information Can Be Broader Than a Diagnosis
EEOC guidance explains that protected medical information can include written or oral details obtained through disability-related questions, medical exams, accommodation requests, or voluntary disclosures. A doctor's note, treatment schedule, mental health condition, medication detail, work restriction, fitness-for-duty form, or explanation connecting a workplace change to a medical condition may qualify. Information does not always need to identify a diagnosis or come directly from a health care professional to require confidential handling.
Medical Records Should Be Separate From Personnel Files
Federal ADA rules require covered employers to collect and maintain qualifying medical information on separate forms and in separate medical files rather than ordinary personnel files. Electronic records need comparable separation and access controls. A diagnosis copied into a routine performance review, shared drive, scheduling note, or broadly visible case system can therefore raise a different issue from a properly restricted medical record.
A Manager May Need Restrictions, Not the Diagnosis
Supervisors and managers may receive information needed to provide an accommodation or follow necessary work restrictions. That exception does not automatically authorize the employer to circulate the employee's full condition, treatment history, or complete medical paperwork. For example, a manager may need to know that lifting is limited or a schedule change is approved without receiving unrelated diagnoses or provider notes. Compare what the recipient needed with what the employer actually revealed.
Coworker Questions Do Not Create a Disclosure Exception
Coworkers may notice modified duties, remote work, additional breaks, leave, a reserved space, or another workplace change. EEOC guidance says an employer generally should not answer those questions by revealing that the employee has a disability or received a reasonable accommodation. The employer can instead explain that it does not discuss another worker's situation and that workplace decisions are handled under company policy.
First Aid and Safety Disclosures Are Limited
First aid or safety personnel may be told information when a medical condition might require emergency treatment or assistance, including help during an evacuation. The exception is connected to that safety need; it is not a general license to disclose every medical detail to an entire team. Record who was told, what emergency or assistance need was identified, and whether the information went further than that purpose required.
Government, Workers' Compensation, and Insurance Uses May Differ
Relevant information may be provided to government officials investigating compliance with federal employment rules. EEOC guidance also recognizes limited disclosure for workers' compensation or insurance purposes. Those channels have their own requirements, and permission to process a claim does not necessarily permit workplace-wide sharing. Keep claim forms, authorizations, notices, recipient names, and the reason given for each disclosure.
FMLA Medical Records Have a Separate Confidentiality Rule
The Family and Medical Leave Act requires covered employers to maintain medical certifications, recertifications, and medical histories created for FMLA purposes as confidential medical records separate from usual personnel files. Supervisors may receive necessary restrictions or accommodations, first aid and safety personnel may receive appropriate emergency information, and government officials may receive relevant information when investigating compliance. The FMLA rule can apply to records about the employee or a family member.
HIPAA Usually Does Not Govern the Employer's Employment File
HHS explains that the HIPAA Privacy Rule generally does not protect employment records, even when they contain health information, and usually does not regulate an employer acting as an employer. HIPAA can still govern a covered health care provider or health plan that holds the person's protected health information. If an employer asks a provider directly for information, the provider generally needs the person's authorization unless another law permits or requires the disclosure. ADA, FMLA, GINA, state law, and employer policy may still protect workplace records when HIPAA does not.
Family Medical History Can Trigger GINA
Family medical history and genetic-test information can be genetic information under the Genetic Information Nondiscrimination Act. Covered entities generally must keep written genetic information in separate medical files and treat it as confidential, with different narrow disclosure exceptions. A form or leave record that mixes the employee's current condition with a relative's medical history may therefore involve both medical-confidentiality and genetic-information rules.
Voluntary Disclosure Does Not Automatically Make Sharing Public
An employee may tell a supervisor about a condition while requesting leave, explaining a restriction, or asking for an accommodation. EEOC guidance treats medical information voluntarily disclosed by an employee as confidential medical information. Telling one workplace recipient for a limited purpose does not necessarily authorize that person to repeat it to coworkers, clients, or other managers who do not need it.
The Reason and Audience Matter More Than the Label
A message marked confidential can still be shared too broadly, while a necessary restriction may be communicated lawfully without naming a diagnosis. Focus on the actual information, how the employer obtained it, who received it, what each person needed to do, and whether the disclosure fit a recognized purpose. Job titles alone do not answer the question; an HR employee, manager, vendor, or insurer may have a need for some information but not every detail.
Federal Coverage Is Not the End of the Review
ADA employment coverage commonly starts at 15 employees, while FMLA coverage and employee eligibility use different tests. State disability, leave, privacy, data-breach, workers' compensation, and common-law rules may be broader or different. A company policy or collective bargaining agreement may also promise additional confidentiality. Do not assume that a small employer has no obligations or that every improper disclosure follows the same filing route.
Retaliation or Job Changes Can Be a Separate Issue
A disclosure may be followed by exclusion, jokes, schedule changes, leave denial, discipline, reduced hours, a bad review, or job loss. Those events can raise disability discrimination, interference, harassment, or retaliation questions separate from record confidentiality. Preserve the dates of the medical request or disclosure, any complaint about it, who knew, what changed, comparison evidence, and every explanation the employer provided.
Preserve the Disclosure Trail Without Taking Restricted Records
Keep the medical request, accommodation or leave form, provider note, authorization, privacy or leave policy, recipient list, email headers, messages, meeting notes, screenshots you are entitled to retain, and the date you learned of the sharing. Write down what was said, by whom, to whom, and any witnesses. Keep only records you may lawfully possess, do not access someone else's account, and do not alter originals.
When to Get a Free Consult
Get a free consult if a diagnosis, treatment detail, accommodation request, restriction, FMLA certification, family medical history, or other medical information was placed in an ordinary personnel record; shared with coworkers or unnecessary recipients; used in a job decision; or followed by retaliation. This article is general information, not legal advice; rights depend on employer coverage, the source and type of information, the reason and scope of disclosure, recipient need, timing, location, and applicable law.
Primary Sources
- U.S. Code: 42 USC 12112 ADA Employment Discrimination and Medical InformationAccessed September 9, 2026
- eCFR: 29 CFR 1630.14 Medical Examinations and InquiriesAccessed September 9, 2026
- EEOC: ADA Primer for Small BusinessAccessed September 9, 2026
- EEOC: Medical Inquiries and Examinations of EmployeesAccessed September 9, 2026
- EEOC: Disability Discrimination Fact SheetAccessed September 9, 2026
- eCFR: 29 CFR 825.500 FMLA RecordkeepingAccessed September 9, 2026
- DOL Fact Sheet #28G: FMLA Medical CertificationAccessed September 9, 2026
- DOL: FMLA Frequently Asked QuestionsAccessed September 9, 2026
- eCFR: 29 CFR 1635.9 Genetic Information ConfidentialityAccessed September 9, 2026
- HHS: Employers and Health Information in the WorkplaceAccessed September 9, 2026
Think You Have a Case?
This article is general information, not legal advice. For a review of your situation, get a free consult with the YesLawyer team.
Get Your Free Consult