An employer can ask for medical records, but only in specific situations tied to a legitimate job need, and even then the request has to be narrow, the records have to be stored separately, and only a limited set of people at the company are allowed to see them. The rules shift depending on whether you’re applying, have just been offered the job, or are already working there, and different federal laws govern different pieces of the process.
What the ADA Allows at Each Stage of Employment
The Americans with Disabilities Act sets three different rules for three different points in the employment relationship, and they get stricter the earlier you are in the process.
Before a Job Offer
Before a conditional offer is on the table, an employer cannot ask whether you have a disability, request medical records, or require a medical exam. They can ask about your ability to perform specific job duties, and if you have an obvious disability or bring one up yourself, they can ask limited questions about what accommodation you’d need.1U.S. Equal Employment Opportunity Commission. Pre-Employment Inquiries and Disability Questions about the nature or severity of a condition are off-limits at this point.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
After a Conditional Offer
Once you’ve received a conditional offer, the employer’s authority widens. They can require a medical examination and condition the offer on the results, but only if every entering employee in the same job category goes through the same process. The results have to be kept on separate forms, in separate medical files, and treated as confidential.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
During Employment
Once you’re on the payroll, the rules tighten again. Your employer cannot require a medical exam or ask about a disability unless the inquiry is job-related and consistent with business necessity. The typical triggers are performance issues that could be linked to a medical condition, or an accommodation request you’ve made yourself. In those cases the employer can ask for documentation supporting the need. A general fishing expedition into your health is not allowed.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
Voluntary wellness screenings are permitted, and any medical information collected through them gets the same confidential-file treatment as a post-offer exam.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
Medical Certification for FMLA Leave
If you request leave under the Family and Medical Leave Act for a serious health condition, your employer can require a medical certification from your health care provider. That certification is limited to a defined list: the provider’s contact information, the approximate start date and expected duration of the condition, relevant medical facts such as symptoms or hospitalizations, and information showing you cannot perform your essential job functions (or that your family member needs care).3U.S. Department of Labor. Fact Sheet 28G – Medical Certification under the Family and Medical Leave Act
Your employer cannot demand more than what fits those categories, and the provider is not required to include a diagnosis. The certification also must not contain genetic test results, information about genetic services, or evidence of disease among family members.3U.S. Department of Labor. Fact Sheet 28G – Medical Certification under the Family and Medical Leave Act The regulations spell out the specific elements that make a certification complete, which helps prevent open-ended requests for your full medical file.4eCFR. 29 CFR 825.306 – Content of Medical Certification
Workers’ Compensation Claims
Workers’ comp is one of the broadest exceptions to medical privacy. HIPAA permits providers and health plans to disclose your protected health information to workers’ comp insurers, state administrators, and employers without your individual authorization, as long as the disclosure is necessary to comply with workers’ compensation laws.5U.S. Department of Health and Human Services. Disclosures for Workers’ Compensation Purposes
That does not hand the employer your whole medical history. HIPAA’s Minimum Necessary standard still applies, so the disclosure should stay tied to the work injury or illness.6U.S. Department of Health and Human Services. Minimum Necessary Requirement If you’re asked to sign an authorization for a workers’ comp claim, read it carefully to confirm it covers only the injury at issue and not every record your doctor has ever created.5U.S. Department of Health and Human Services. Disclosures for Workers’ Compensation Purposes
Genetic Information and Family Medical History
One category of medical information is essentially off-limits regardless of the stage of employment. Under Title II of the Genetic Information Nondiscrimination Act, employers are prohibited from requesting, requiring, or purchasing genetic information about you or your family members.7U.S. Equal Employment Opportunity Commission. Background Information for EEOC Final Rule on Title II of the Genetic Information Nondiscrimination Act “Genetic information” is defined broadly enough to include your family medical history, not just DNA test results.
The ban on using genetic information in employment decisions is absolute. The EEOC has stated that the possibility of developing a condition in the future has nothing to do with your current ability to do the job.7U.S. Equal Employment Opportunity Commission. Background Information for EEOC Final Rule on Title II of the Genetic Information Nondiscrimination Act Even inadvertent acquisition can count. Narrow exceptions exist for voluntary wellness programs (with written authorization and results going only to a licensed health professional) and for family history disclosed through an FMLA certification, which must still be kept confidential.8GovInfo. 42 USC 2000ff-1 – Employer Practices
Doctor’s Notes, HIPAA, and a Common Misconception
Many people assume HIPAA blocks their employer from asking about their health. It doesn’t work that way. HIPAA governs health care providers, health plans, and clearinghouses. It does not regulate employers in their role as employers. Your boss asking you for a doctor’s note is not a HIPAA issue, and your employer can request health information tied to sick leave, workers’ comp, wellness programs, or health insurance without violating HIPAA.9U.S. Department of Health and Human Services. Employers and Health Information in the Workplace
Where HIPAA does have teeth is on the provider side. If your employer contacts your doctor directly, the doctor cannot release your records without your written authorization unless another law requires the disclosure.9U.S. Department of Health and Human Services. Employers and Health Information in the Workplace So the practical wall between your employer and your full chart is your signature.
How Your Employer Has to Store Medical Information
The ADA imposes a storage rule that many employers get wrong. Any medical information collected about an employee, whether from a post-offer exam, an accommodation request, or a voluntary wellness program, has to be kept on separate forms, in separate medical files, physically apart from the general personnel file.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
Access to those files is restricted. Supervisors may see only what’s necessary to implement work restrictions or accommodations. First aid and safety staff may be told about conditions that could require emergency treatment. Government compliance investigators get access on request. Everyone else, including coworkers, other managers, and HR staff without a specific role in the accommodation process, should be locked out.2Office of the Law Revision Counsel. 42 USC 12112 – Discrimination If your medical information is sitting in your regular personnel file, that’s a violation on its face.
Signing an Authorization Form
Outside the situations covered above, an employer generally needs your written consent to reach your medical information. A proper authorization specifies what information can be disclosed, who can see it, and the purpose. Watch for forms that ask for “any and all medical records.” That language goes far beyond what most legitimate workplace requests require, and you’re generally within your rights to narrow the scope to the injury, condition, or accommodation actually at issue.
You can refuse to sign. Refusal has consequences, though. If you decline to provide medical documentation your employer has legitimately requested as part of the ADA interactive process, the employer is not obligated to keep working on your accommodation request. The same is true of an FMLA certification: without adequate documentation, the employer can deny the leave.9U.S. Department of Health and Human Services. Employers and Health Information in the Workplace Consent is voluntary, but withholding it when the request is legally valid can cost you the benefit you were seeking.
State Laws Can Go Further
Federal law is a floor. Many states impose additional restrictions on employer access to medical information, and they vary widely. Some require written authorization before any employer access. Others limit what an employer-requested provider can share to functional limitations affecting your ability to work, without revealing the underlying medical cause. A handful give employees a private right of action with statutory damages when medical confidentiality is breached. Check your state’s rules before assuming the federal outline is the whole picture.
What to Do If Your Employer Crosses the Line
If you believe your medical information was improperly accessed or disclosed by a covered entity like a health plan or provider, you can file a complaint with the Office for Civil Rights at HHS through its online portal or in writing. The deadline is 180 days from when you knew or should have known the violation occurred, though OCR can extend that window for good cause.10U.S. Department of Health and Human Services. How to File a Health Information Privacy or Security Complaint You don’t have to be the affected person to file.11U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint
For violations of the ADA’s medical confidentiality requirements by your employer, complaints go to the EEOC. If your state has its own medical privacy law, your state attorney general’s office or a dedicated state agency may handle those complaints separately. HIPAA civil penalties reach into the millions per year for the most serious violations, and the criminal provisions apply to individuals, not just organizations, so the person who mishandled the information can face personal exposure.