An HR confidentiality policy sets out which employee and business records must stay private, who inside the organization may see them, and what happens when someone discloses them without authorization. Federal law pulls in two directions at once: several statutes require employers to protect specific categories of data, while others prohibit employers from using confidentiality rules to silence workers who discuss pay or report misconduct. A policy that ignores either side creates liability, so the drafting job is really a balancing job.
What the Policy Has to Protect
Not every sensitive record falls under the same rule. The categories below carry different federal obligations, and treating them uniformly is one reason policies get challenged.
- Personally identifiable information: Social Security numbers, dates of birth, home addresses, direct-deposit bank details, and immigration documents.
- Medical and disability records: medical exam results, accommodation requests, drug test outcomes, workers’ compensation claims, and FMLA documentation. Federal law requires these to be stored separately from standard personnel files.
- Genetic information: family medical history, genetic test results, and information about an employee’s participation in genetic services. A separate federal statute governs this category entirely.
- Performance and disciplinary records: evaluations, written warnings, internal investigation findings, and termination documentation. No single federal statute covers these, but careless disclosure can support defamation or retaliation claims.
- Compensation data: salary structures, bonus formulas, and equity grants. The company has a legitimate interest in keeping the structure proprietary, but employees have a federally protected right to discuss their own pay with coworkers.
- Trade secrets and proprietary business information: client lists, internal strategies, product formulas, and marketing plans. Federal law provides a civil cause of action when these are stolen or leaked.
Federal Laws That Require Confidentiality
No single statute covers workplace confidentiality. Several laws each protect a specific type of information and impose different storage and access rules.
Americans With Disabilities Act
The ADA is the primary federal law forcing employers to wall medical information off from general personnel files. Under 42 U.S.C. § 12112, any information obtained through medical examinations or disability-related inquiries must be collected on separate forms and stored in separate medical files, treated as confidential medical records.1Office of the Law Revision Counsel. 42 USC 12112 – Discrimination Only three narrow groups can access this material: supervisors who need to know about work restrictions or accommodations, safety personnel who may need it for emergency treatment, and government officials investigating ADA compliance.
A common misconception is that HIPAA drives this separation. It generally does not. The U.S. Department of Health and Human Services states that the HIPAA Privacy Rule does not protect employment records, even health-related ones, and that in most cases the Privacy Rule does not apply to an employer’s actions.2U.S. Department of Health and Human Services. Employers and Health Information in the Workplace HIPAA does apply when the employer administers a group health plan, but that duty attaches to the health plan component, not to the personnel file system. Build the medical-file separation around the ADA.
Genetic Information Nondiscrimination Act
GINA makes it illegal for employers to request, require, or purchase genetic information about employees or their family members, with narrow exceptions like inadvertent acquisition or FMLA certification.3U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008 When genetic information is lawfully obtained, GINA requires it to be maintained in separate confidential files, following the framework the ADA established. Even aggregate genetic data from voluntary wellness programs cannot be disclosed in a way that identifies individual employees.
Defend Trade Secrets Act and Its Required Notice
The DTSA, at 18 U.S.C. § 1836, gives employers a federal civil cause of action when someone misappropriates a trade secret. If the misappropriation was willful and malicious, a court can award exemplary damages up to twice the compensatory damages.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings There is a catch. Employers only get access to those enhanced damages and attorney fees if they include the whistleblower immunity notice required by 18 U.S.C. § 1833 in their confidentiality agreements. Every contract or agreement governing trade secrets or confidential information must notify employees that they are immune from liability for disclosing a trade secret to a government official or attorney to report a suspected legal violation, or in a sealed court filing.5Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions Skip the notice, and the exemplary damages and fees disappear. This is one of the most overlooked drafting requirements in employment agreements.
A Note on HIPAA
If the organization sponsors a group health plan, mishandled plan records trigger HIPAA penalties that are adjusted annually for inflation and, for uncorrected willful neglect, can reach over $2.1 million per year for a single type of violation.6Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Treat that compliance work as a separate obligation rather than folding it into a general HR confidentiality policy.
What the Policy Cannot Restrict
This is where policies most often fail. An overly broad rule that chills legally protected employee speech can be struck down in full and expose the employer to further liability. Several federal protections carve out areas where confidentiality rules simply do not apply.
Wage and Working Condition Discussions
Section 7 of the National Labor Relations Act guarantees employees the right to engage in concerted activities for mutual aid or protection. In practice, employees can discuss their wages, benefits, hours, and working conditions with each other, and an employer cannot prohibit or punish those conversations.7Office of the Law Revision Counsel. 29 USC 157 – Rights of Employees The protection extends to conversations about supervisor behavior, workplace safety concerns, and union organizing. It applies to most private-sector employees whether or not a union is present.8Cornell Law Institute. National Labor Relations Act
The National Labor Relations Board actively reviews employer policies for language that could discourage these discussions, and pay secrecy rules are a recurring target. A policy that tells employees they cannot share “compensation information” or “internal company data” without carving out wage discussions among coworkers risks an unfair labor practice finding. The remedy usually includes rescinding the offending policy, posting a notice of employees’ rights, and in some cases back pay for employees disciplined under the unlawful rule.
Whistleblower Protections
Several federal laws bar confidentiality agreements from blocking employees who report suspected legal violations to the government.
SEC Rule 21F-17(a) prohibits any person from impeding an individual from communicating directly with the SEC about a possible securities law violation, including by enforcing or threatening to enforce a confidentiality agreement.9eCFR. 17 CFR 240.21F-17 – Staff Communications With Individuals Reporting Possible Securities Law Violations The SEC has brought enforcement actions against companies whose agreements required employees to get company approval before contacting regulators, waive whistleblower awards, or notify the company after filing a report.10U.S. Securities and Exchange Commission. Whistleblower Protections Internal compliance manuals and training materials can violate the rule too if they contain overly restrictive language.
The Sarbanes-Oxley Act protects employees of publicly traded companies from retaliation for reporting conduct they reasonably believe constitutes securities, mail, wire, or bank fraud to a federal agency, Congress, or an internal supervisor. Those rights cannot be waived by any agreement, policy, or condition of employment.11Whistleblower Protection Program. Sarbanes-Oxley Act (SOX)
The DTSA provides its own immunity for employees who disclose trade secrets to government officials or attorneys to report suspected legal violations, or in sealed filings in retaliation lawsuits.5Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions A policy that omits this carveout is not only legally exposed; it also forfeits the enhanced damages the employer would otherwise be able to seek in trade secret litigation.
Sexual Harassment and the Speak Out Act
Since 2022, the Speak Out Act has made pre-dispute nondisclosure and nondisparagement clauses unenforceable in cases involving sexual assault or sexual harassment. If an employee signed a broad confidentiality agreement before a harassment dispute arose, those provisions cannot be used to prevent the employee from discussing the alleged conduct.12Office of the Law Revision Counsel. 42 USC Chapter 164 – Speak Out Act The law reaches clauses agreed to before the dispute, so post-settlement confidentiality agreements remain enforceable. Reflect that distinction in the policy rather than claiming blanket confidentiality over all workplace complaints.
Investigation Confidentiality Has Limits
Employers can generally require confidentiality during an active internal investigation. The NLRB ruled in 2019 that investigation confidentiality rules limited to the duration of the investigation are presumptively lawful.13National Labor Relations Board. Board Approves Greater Confidentiality in Workplace Investigations The key word is “limited.” A policy that tries to impose permanent silence about the subject matter of an investigation, rather than confidentiality while the investigation is open, remains vulnerable to challenge.
What an Enforceable Policy Contains
A policy that tries to cover everything often ends up covering nothing, because courts void overbroad restrictions. The stronger approach is specific about what is protected and honest about what is not.
Start with a clear definition of confidential information. Vague terms like “all internal information” or “company matters” invite challenges. Identify categories: employee medical records, trade secrets, client data, internal financial projections, investigation findings. Explicitly exclude information already public, information the employee knew before hire, and information received from a third party with no confidentiality restriction.
State the duration of the obligation, category by category. Investigation confidentiality ends when the investigation closes. Trade secret obligations often survive employment indefinitely because the competitive harm persists. General business information typically has a defined period, often one to three years after departure, though enforceability varies by jurisdiction. Separate timelines for separate categories hold up better than a single blanket duration.
Include every legally required exception. At a minimum, the policy has to acknowledge NLRA Section 7 rights to discuss wages and working conditions, whistleblower protections under federal and state law, and the DTSA immunity for confidential disclosures to government officials or attorneys.5Office of the Law Revision Counsel. 18 USC 1833 – Exceptions to Prohibitions It should also note that compliance with a lawful subpoena or court order is not a breach. Burying these exceptions in fine print defeats the purpose. An employee reading the policy should be able to see the carveouts without needing a lawyer.
Finally, specify the process for returning or destroying confidential materials at separation, identify who authorizes exceptions, and explain how employees should report a suspected breach. A policy that tells people what they cannot do but not what to do in ambiguous situations creates more problems than it solves.
Consequences for Violating the Policy
Consequences depend on what was disclosed and how.
Internally, most policies authorize progressive discipline up to termination, calibrated to severity. An accidental misaddressed email is not the same as deliberately leaking salary data to a competitor. Many employment agreements also contain liquidated damages clauses setting a pre-determined amount owed for a breach. Courts generally enforce those clauses when the amount is tied to anticipated harm and does not function as a punishment.
Civilly, the DTSA lets an employer sue a current or former employee who misappropriates trade secrets in federal court and recover compensatory damages based on actual losses and unjust enrichment. Willful and malicious misappropriation opens the door to exemplary damages of up to twice the compensatory amount, plus attorney fees.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Courts can also enter injunctions preventing further disclosure, which can effectively restrict where a former employee works if the new role would inevitably expose the trade secret.
Criminal exposure exists too. When an employee or former employee accesses HR systems without authorization, the Computer Fraud and Abuse Act at 18 U.S.C. § 1030 can apply. Federal courts have held that a former employee who uses a current employee’s login credentials after their own access has been revoked is acting “without authorization” under the statute. The distinction that matters is between having no permission at all and having permission and misusing it; employees authorized to use workplace computers who violate an internal use policy are generally not criminally liable under the CFAA.
Trade secret theft can be prosecuted under the Economic Espionage Act at 18 U.S.C. §§ 1831–1832, which carries fines up to $5 million and prison sentences up to 10 years for individuals, with higher penalties when the theft benefits a foreign government.