Performance reviews are not automatically confidential under any single federal law. Whether your evaluation stays private depends on three things working together: the Americans with Disabilities Act (which locks down any medical information), your employer’s own written policies and contracts, and the personnel-file law in your state. Employees also keep a separate right, under federal labor law, to talk about their own reviews with coworkers, no matter what the handbook says.
There Is No Blanket Federal Privacy Law for Reviews
Two federal statutes often get named in this context, and both are red herrings.
HIPAA does not apply. The HIPAA Privacy Rule explicitly excludes employment records that an employer maintains in its capacity as an employer, even when the employer is a hospital or health plan.1U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule A manager’s write-up about your attendance, output, or attitude is an employment record, not protected health information.
The Fair Credit Reporting Act does not apply either. FCRA governs consumer reports purchased from third-party screening companies, not evaluations your own managers write internally.2Federal Trade Commission. What Employment Background Screening Companies Need to Know About the Fair Credit Reporting Act If your employer pulls a background report to inform a promotion or retention decision, FCRA’s notice-and-consent rules kick in.3Federal Trade Commission. Using Consumer Reports: What Employers Need to Know The internal review is not that kind of report.
So there is no general federal rule saying “your performance review is private.” Confidentiality, when it exists, comes from somewhere else.
Medical Information Is the One Thing Federal Law Protects
The Americans with Disabilities Act requires employers to keep any medical information they collect about an employee on separate forms, in separate medical files, and to treat it as a confidential medical record. This applies to every employee, not only those with a known disability. If your review references a medical condition, a doctor’s note, or details from a fitness-for-duty exam, that information must live in a separate file with restricted access. Only supervisors who need to know about work restrictions or accommodations, first-aid personnel in emergencies, and government officials investigating ADA compliance are allowed to see it.4Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination
Employers that fold medical records into a general personnel file, even at termination, violate the ADA’s confidentiality provision. Courts have treated that as a straightforward violation, and it is a claim that stands on its own regardless of whether any underlying discrimination occurred.
Your Employer’s Policy Is Usually the Real Source of Confidentiality
Most confidentiality obligations come from the employer’s own handbook, employment agreement, or collective bargaining agreement. Many organizations promise in writing that reviews will be shared only on a need-to-know basis. Those promises are enforceable. If a manager forwards your review to the whole department, you may have a breach-of-contract claim based on the company’s own policy, even if no federal privacy statute was technically violated.
Read the confidentiality language in your handbook and offer letter. That is where the enforceable promise lives.
You Can Discuss Your Own Review With Coworkers
This is where many employer policies overreach. The National Labor Relations Act protects employees’ right to engage in concerted activities for mutual aid or protection.5Office of the Law Revision Counsel. 29 U.S. Code 157 – Right of Employees as to Organization, Collective Bargaining In practice, that means you can talk with coworkers about your wages, working conditions, and the content of your performance review. This right applies whether your workplace is unionized or not.
The National Labor Relations Board has found that overly broad confidentiality and non-disparagement rules interfere with Section 7 rights because they stop workers from discussing wages, hours, and working conditions with each other and from seeking help from a union or from the NLRB.6National Labor Relations Board. Interfering with Employee Rights (Section 7 and 8(a)(1)) So an employer can restrict who inside management sees your review, but it generally cannot forbid you from telling a colleague what was in yours. A handbook clause that says “performance reviews are strictly confidential and may not be discussed” is legally risky for the employer.
Who Should Have Access Internally
Inside the company, access should be limited to people with a legitimate business reason to see the review: your direct supervisor, HR staff running the review process, and senior leaders involved in promotion or compensation decisions. Employees are often entitled to know who those people are, and asking is reasonable.
Informal notes matter here too. A manager’s desk notes, documenting emails, and handwritten observations about your work are legally part of the personnel record if they relate to the terms and conditions of your employment or were relied on in making a decision about you. In states with personnel-file access laws, those notes must be produced when you ask to inspect your file. They are also discoverable in litigation.
Your Right to See Your Own File
Your right to inspect what your employer has written about you depends heavily on the state. Roughly half the states have statutes giving employees the right to inspect or copy their personnel file. Deadlines for employer compliance range from as few as five business days to as many as forty-five, with some states using a vague “reasonable time” standard. A handful of states have no private-sector access law at all. Even where no statute requires it, most employers do allow employees to review their formal evaluations.
When Your Review Can Be Disclosed Anyway
Even a strong confidentiality policy has limits.
Lawsuits and Government Investigations
If you file a discrimination charge, a wrongful termination suit, or any other employment claim, your employer will almost certainly have to produce relevant performance records in discovery. A court order or subpoena overrides any internal confidentiality policy. Government agencies investigating workplace complaints can also compel access, and once a discrimination charge is pending, the employer must preserve all personnel records relevant to the charge until the matter is fully resolved.7eCFR. 29 CFR Part 1602 Subpart C – Recordkeeping by Employers
Audits and Outside Reviews
External auditors or consultants sometimes need access to performance data for compliance reviews, pay-equity analyses, or workplace investigations. Good practice is to anonymize data where possible and require third parties to sign confidentiality agreements before receiving any files.
Federal Employees Have Extra Protection
If you work for a federal agency, the Privacy Act of 1974 adds a layer that private-sector workers do not have. It prohibits federal agencies from disclosing any record from a system of records without the written consent of the individual it concerns, except through specific exceptions such as disclosure to agency employees who need the record for their duties, disclosures required by the Freedom of Information Act, or disclosures ordered by a court. Performance evaluations fall within the statute’s definition of records. The Privacy Act also requires agencies to maintain administrative, technical, and physical safeguards against anticipated threats.8Office of the Law Revision Counsel. 5 U.S. Code 552a – Records Maintained on Individuals Private-sector employers have no equivalent federal duty; their obligation to safeguard review data comes from state law and their own policies.
One boundary worth naming for union-represented employees: the Weingarten right to have a union representative present does not attach to a routine performance evaluation. It attaches when a supervisor is questioning an employee to gather information that could lead to discipline.9National Labor Relations Board. Weingarten Rights If a review meeting is really a fact-finding session that might produce a write-up, the line shifts and you can request representation.
What Happens When Confidentiality Is Breached
If your review gets shared with people who had no business seeing it, several claims can follow. Breach of contract, if the employer’s policy promised confidentiality. Invasion of privacy. Defamation, if a manager passes negative performance information to someone without a legitimate business reason to receive it and the information turns out to be false or misleading.
Employers do have a defense called qualified privilege, which protects good-faith communications between people who share a legitimate business interest, such as a manager discussing an employee’s performance with HR or with a senior leader making a staffing decision. Qualified privilege is not absolute. It can be lost if the statement was made with malice, was known to be false, or was shared more widely than the business purpose required. Spreading a negative review to colleagues who play no role in the employment decision is the fastest way to lose it.
If the breach involves medical information that should have been in a separate ADA file, the employer faces an additional, standalone claim under the ADA’s confidentiality provision.4Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination