Can My Employer Talk About My Medical Condition at Work?

In most situations, your employer cannot talk about your medical condition at work. The Americans with Disabilities Act requires employers to treat any medical information they learn about you as a confidential record, kept in a separate file and shared only with a short list of people who have a specific reason to know. The rule applies whether the employer learned about your condition through a medical exam, an accommodation request, or a private conversation you had with your manager.

There are real exceptions, and the wrong law gets blamed for these disclosures all the time. Knowing which rule actually applies changes where you complain and what you can recover.

What Counts as Protected Medical Information

Under the ADA, any information about your medical condition or history that your employer obtains has to be collected on separate forms, kept in separate medical files, and treated as a confidential medical record.¹ It doesn’t matter how the employer got it. A pre-employment exam, a fitness-for-duty evaluation, a doctor’s note supporting an accommodation, an FMLA certification—all of it is confidential.

The EEOC has made clear that medical information an employee volunteers is also covered.² If you tell your supervisor in confidence that you have multiple sclerosis, or you mention a recent diagnosis while explaining why you were out sick, your employer cannot pass that along to coworkers. The confidentiality obligation attaches the moment the employer possesses the information.

One notable boundary: drug test results are not treated as medical examinations under the ADA and fall outside its medical confidentiality protections, though some states restrict disclosure separately.³

Who Your Employer Is Allowed to Tell

The ADA lists a narrow group of people who can receive medical information about you, and only when they need it:

Supervisors and managers, to the extent they need to know about necessary work restrictions or accommodations.
First aid and safety personnel, when your condition might require emergency treatment.
Government officials investigating compliance with the ADA.

Those three exceptions come straight from the statute.¹ The EEOC has also read the ADA to permit disclosure to workers’ compensation offices, workers’ compensation insurance carriers, and health care professionals when the employer is asking for advice about a reasonable accommodation.²

The limit that runs through every exception is necessity. Telling your supervisor that you need a standing desk is fine. Telling that same supervisor you have degenerative disc disease is not, because the diagnosis itself isn’t required to implement the accommodation. Most employer missteps happen here: sharing the underlying condition when only the restriction needed to be shared.

Safety and Court-Ordered Disclosures

An employer may disclose limited medical information when an employee poses a direct threat to health or safety. A “direct threat” means a significant risk of substantial harm that cannot be eliminated or reduced through reasonable accommodation, and the employer must base that judgment on an individualized assessment of the risk’s duration, severity, likelihood, and imminence.² A vague sense that someone “seems off” doesn’t clear that bar.

Employers can also disclose medical information when compelled by a court order or as part of a government investigation, and the disclosure should be no broader than what the order requires.

Why HIPAA Usually Isn’t the Right Law Here

People often assume HIPAA is what stops a boss from talking about their diagnosis. In the employment context, it usually isn’t. HIPAA covers health plans, health care providers, and health care clearinghouses. Your employer is not a covered entity just because it sponsors your health insurance.⁴

The group health plan is a separate legal entity from the employer that sponsors it, and the plan is the covered entity. HIPAA’s Privacy Rule controls when the plan can share protected health information back to the employer, and requires the employer to certify it will protect the information and not use it for employment decisions.⁴

So if your manager learned your diagnosis from insurance claims data and told coworkers, there may be a HIPAA violation by the plan for sending that data to your manager improperly. The manager’s act of gossiping, though, is an ADA problem, not a HIPAA one. That distinction matters when you decide where to file.

FMLA, Genetic Information, and Wellness Programs

The same confidentiality principle carries into other federal statutes. Medical certifications you submit under the Family and Medical Leave Act must be kept as confidential medical records in separate files, with the same three exceptions the ADA allows. If those records include family medical history or genetic information, they must also meet GINA’s confidentiality requirements.⁵

The Genetic Information Nondiscrimination Act adds its own layer for genetic data and family medical history, which the ADA doesn’t explicitly cover. GINA prohibits employers from requesting or purchasing genetic information and strictly limits disclosure of any they happen to hold.⁶ Permitted disclosures are narrow: at the employee’s written request, to researchers under federal human-subjects protections, in response to a court order with notice to the employee, to government officials investigating GINA compliance, for FMLA certification purposes, or to a public health agency about a contagious disease posing an imminent hazard.⁷

Workplace wellness programs sit at the crossroads of these rules. Under GINA’s final rule on wellness programs, an employer cannot require an employee or spouse to agree to the sale, exchange, or distribution of health information as a condition of participating, and cannot retaliate against an employee whose spouse refuses to provide health information.⁸ Individual-level results tied to your name should not be reaching your employer.

What to Do If Your Employer Disclosed Your Condition

For an ADA violation, your primary route is a charge with the Equal Employment Opportunity Commission. You generally have 180 days from the date of the disclosure to file, extended to 300 days if a state or local agency enforces a law prohibiting the same type of discrimination, which covers most states.⁹ Miss the deadline and you can forfeit the claim.

After investigation, the EEOC either finds reasonable cause and attempts conciliation (and may sue on your behalf), or issues you a right-to-sue letter. From the date of that letter, you have 90 days to file your own lawsuit in federal court.¹⁰ That clock is just as firm.

If the disclosure involves your employer’s group health plan mishandling your information, you can file a separate complaint with the HHS Office for Civil Rights.¹¹ HIPAA doesn’t give you a private lawsuit, but OCR can investigate and impose penalties on the covered entity.

Many states also have their own laws against unauthorized disclosure of medical information, sometimes with longer filing windows and different damages, and some allow you to sue in state court without going through the EEOC first. The specifics vary, so check your state’s law or talk to a local employment attorney.

What You Can Recover

An employer found liable under the ADA can owe compensatory damages for emotional distress and other nonpecuniary losses, plus punitive damages for egregious conduct. The combined total of compensatory and punitive damages is capped by employer size:¹²

15 to 100 employees: $50,000
101 to 200 employees: $100,000
201 to 500 employees: $200,000
More than 500 employees: $300,000

Back pay and front pay for lost wages are calculated separately and are not subject to those caps. The EEOC can also require the employer to revise confidentiality policies, train staff on ADA compliance, and change how it handles medical records going forward.¹³

If Your Employer Retaliates for Complaining

Filing a complaint about a medical privacy disclosure is itself a protected activity. The ADA prohibits retaliation against anyone who files a charge, participates in an investigation, or opposes a practice they reasonably believe violates the law.³ Retaliation can take the form of termination, demotion, an unjustified negative evaluation, or any action that would deter a reasonable person from pursuing a complaint.

If your employer retaliates, that is a separate violation you can add to your EEOC charge, with the same remedies available for the underlying disclosure. Fear of losing a job keeps many employees quiet; the law treats that fear seriously enough to make the retaliation actionable on its own.

1
Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination
2
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA
3
ADA.gov. Americans with Disabilities Act of 1990, As Amended
4
HHS.gov. Am I a Covered Entity Under HIPAA?
5
eCFR. 29 CFR 825.500 – Recordkeeping Requirements
6
U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination
7
Office of the Law Revision Counsel. 42 USC Chapter 21F – Prohibiting Employment Discrimination on the Basis of Genetic Information
8
U.S. Equal Employment Opportunity Commission. EEOC’s Final Rule on Employer Wellness Programs and the Genetic Information Nondiscrimination Act
9
U.S. Equal Employment Opportunity Commission. Time Limits For Filing A Charge
10
U.S. Equal Employment Opportunity Commission. What You Can Expect After a Charge is Filed
11
HHS.gov. Filing a Health Information Privacy Complaint
12
Office of the Law Revision Counsel. 42 U.S. Code 1981a – Damages in Cases of Intentional Discrimination
13
U.S. Equal Employment Opportunity Commission. The ADA: Your Responsibilities as an Employer