Employee medical records under the ADA, FMLA and GINA, and where they leak

The HIPAA Privacy Rule doesn't cover an employer's records about its own staff, even when they hold health information and even at a hospital. An employee's medical details fall under three other federal laws instead: the Americans with Disabilities Act, the Family and Medical Leave Act and the Genetic Information Nondiscrimination Act. Each requires them to be kept as a confidential medical record, apart from the personnel file, and each limits who may be told. A supervisor may learn about work restrictions and accommodations; the diagnosis behind them stays in the medical file.

The rule is about where records are kept. Following it is harder, because medical details turn up in emails, schedules and investigation files that were never meant to hold them.

Which law covers what

The three laws overlap, and many employers answer to all of them at once. Their confidentiality rules are in 29 CFR 1630.14 for the ADA, 29 CFR 825.500(g) for the FMLA and 29 CFR 1635.9 for GINA.

Law	What must be kept confidential and apart from the personnel file
ADA, at employers with 15 or more employees	Medical information from exams and disability-related questions
FMLA, at employers with 50 or more employees and public agencies	Certifications, recertifications and medical histories of employees and their family members, created for FMLA leave
GINA, at employers with 15 or more employees	Genetic information, including family medical history

The thresholds are in 42 U.S.C. 12111 for the ADA and 29 U.S.C. 2611 for the FMLA, and GINA adopts Title VII's definition of employer. The ADA rule covers any employee, not only one with a disability, and the EEOC's guidance on medical inquiries reads it to include medical information an employee volunteers.

Each law also limits who may be told:

Under the ADA, and the FMLA where the ADA applies: supervisors and managers, about necessary work restrictions and accommodations; first aid and safety staff, if the condition might need emergency treatment; and government officials investigating compliance. The EEOC's guidance adds state workers' compensation offices and insurers, and health care professionals advising on an accommodation.
Under GINA: the employee, on written request; health researchers; a court, only as far as its order authorizes; government officials investigating compliance; and public health agencies, about a contagious disease that poses an imminent hazard. Disclosures that support an employee's FMLA certification are allowed too.

Coworkers aren't on either list. The EEOC's guidance on reasonable accommodation says an employer may not even tell them that someone is receiving an accommodation, because that usually amounts to disclosing a disability.

Where HIPAA does apply

The definition of protected health information in 45 CFR 160.103 excludes employment records held by a covered entity in its role as employer, alongside the student records FERPA covers, and HHS confirms that this holds even for health-related records. HIPAA still reaches three places an employee's health information passes through:

The doctor. An employer may ask an employee for a doctor's note, but the doctor generally can't send one straight to the employer without the employee's authorization.
A hospital's own patients. A nurse's leave paperwork is an employment record. The chart from that nurse's own treatment at the hospital is protected health information.
The group health plan. The plan is a covered entity, and under 45 CFR 164.504(f) it may not give the employer members' health information for employment decisions.

Where medical details leak from employee files

The separate-file rule assumes medical information arrives as a medical record. Most of it arrives as everyday paperwork, and it travels: to managers, investigators, outside counsel, the EEOC and, in litigation, the other side.

Doctors' notes and return-to-work slips

A note says more than the dates: "Paul Hendricks was seen 3/9 for a lumbar disc herniation; no lifting over 10 lb until 4/6." The lifting limit can go to his supervisor. The diagnosis stays in the medical file, and so does the letterhead when the clinic's name gives the condition away. Many notes arrive as faxes or phone photos.

FMLA certifications

The Department of Labor's form WH-380-E invites the provider to add symptoms, a diagnosis and a treatment regimen, and asks for the provider's medical specialty: "Oncology" says the rest. The form itself reminds employers to keep it as a confidential medical record, separate from the personnel file. Form WH-380-F describes a family member's condition instead, which GINA treats as family medical history.

Accommodation requests and their email trail

The interactive process runs on email: "Nadia's endocrinologist says she needs a break every two hours to check her glucose." Forwarded to whoever builds the schedule, the thread carries the diagnosis to people who needed only the break times.

Schedules, calendars and leave codes

Attendance records must show which days were FMLA leave, so they do. A shared calendar adds more: "PH out Tues, PT for back". They go wherever the schedule or the mailbox goes, into an investigation file or a discovery production.

Investigation files and performance reviews

Investigations collect witness statements ("she said it was her new meds"), leave histories and doctors' notes attached as exhibits. Reviews mention conditions to explain a bad quarter: "missed targets after his surgery". When the file goes to outside counsel, an insurer or the other side, each of these needs a decision.

Position statements to the EEOC

The EEOC gives a respondent's position statement and its non-confidential attachments to the charging party on request. Its procedures ask respondents to refer to sensitive medical information without identifying it, and to put it in separate attachments labeled "Sensitive Medical Information". That excludes the charging party's own medical information, but not a coworker's or a comparator's.

A checklist before employee files leave HR

Doctors' notes, FMLA certifications and accommodation records are in the medical file, not the personnel file.
Supervisors have the restrictions and accommodations they need, and nothing about the diagnosis.
Diagnoses, medications, specialties and clinic names are gone from records going to anyone outside the regulations' lists.
Family members' conditions, on FMLA forms and in emails, are treated as genetic information.
Investigation files, performance reviews and email threads have been checked for medical details, not only the medical file.
In an EEOC position statement, medical details about anyone but the charging party are in a separate attachment labeled "Sensitive Medical Information".
Faxed notes and scanned forms have been read by OCR and checked by a person.
Redacted text is removed, not covered, and document properties, comments and attachments are clean.

Where DocArmor fits

DocArmor's Blind Hiring & Bias Reduction template is built for resumes, and the same workflow covers investigation files, performance reviews and records shared with outside counsel. A plain-English instruction such as "remove diagnoses, medications, treating providers and family members' health conditions" adds what an employee file needs. OCR reads scanned and faxed pages, and every finding goes to a reviewer before export, because whether "after his surgery" says too much in a given file is a judgment a person has to make. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped.

This post is general information about federal employment law, not legal advice. State laws can add their own rules on employee medical information, so check yours with employment counsel.

Frequently asked questions

Does HIPAA apply to employers?

Generally, no. The HIPAA Privacy Rule excludes employment records held by a covered entity in its role as employer, so an employee's doctor's note or leave certification isn't protected health information, even at a hospital. HIPAA does govern an employer's group health plan, which may not pass members' health information to the employer for employment decisions.

Can medical records be kept in an employee's personnel file?

No. The ADA requires medical information from employment-related exams and inquiries to be kept on separate forms and in separate medical files, as a confidential medical record. FMLA certifications and genetic information under GINA must also be kept apart from the personnel file, and genetic information may share the ADA medical file.

Can HR tell a manager about an employee's medical condition?

Only what the manager needs. Under the ADA and the FMLA, supervisors and managers may be told about necessary restrictions on the employee's work and necessary accommodations, first aid and safety staff may be told when the condition might need emergency treatment, and government investigators get relevant information on request. Coworkers aren't on the list.

Is family medical history protected under GINA?

Yes. GINA counts family medical history, meaning diseases or disorders that have appeared in an employee's family members, as genetic information. An employer that has it in writing must keep it in a confidential medical file apart from the personnel file, and may disclose it only in the few cases the regulations list, such as an FMLA certification or a court order.