Who Should Not Have Access to Employee Medical Records?

Employee medical records are not supposed to be open to everyone at a company. Even when an employer legitimately needs some health information, access should generally be limited to people who have a specific reason to receive it.

The rules can be confusing because HIPAA medical records release laws and workplace medical privacy laws do not cover exactly the same information. HIPAA protects certain medical information held by healthcare providers and health plans, but it generally does not apply to employment records maintained by an employer. Employee medical information can also be protected by laws such as the Americans with Disabilities Act (ADA), which requires employers to keep medical information confidential and separate from ordinary personnel records.

That means your manager, coworkers, HR staff, or other employees do not automatically have a right to see your diagnosis, treatment details, or complete medical records simply because you work for the company.

TL;DR: Key Takeaways

• Employee medical information should generally be kept confidential and separate from regular personnel files.
• Coworkers should not have access to an employee's medical records simply because they work at the same company.
• Managers and supervisors may receive limited medical information when necessary to handle work restrictions or reasonable accommodations.
• First aid and safety personnel may need certain information during an emergency.
• HR or designated personnel may need access when handling legitimate employment matters, but access should be limited.
• HIPAA does not generally regulate employment records maintained by an employer.
• Healthcare providers generally cannot send medical information directly to an employer without the employee's authorization, unless another applicable law permits or requires the disclosure.

Have questions about your health or need a clinician to review symptoms? Try August AI's free symptom assessment to help think through your symptoms and possible next steps. AI triage is not a diagnosis. If you're dealing with a medical emergency, call 911 or go to the nearest ER. For workplace medical privacy concerns, contact your employer's HR department or an appropriate legal professional.

Who Should Not Have Access to Employee Medical Records?

The basic rule is simple: employee medical information should only be available to people who have a legitimate reason to receive it.

Under the ADA, employers must keep medical information about applicants and employees confidential. That includes information that does not contain a specific diagnosis. The EEOC also recommends keeping medical information in separate medical files rather than ordinary personnel files.

The same principle applies when information is stored electronically. Having access to a company's computer system does not automatically mean an employee should be able to view another employee's medical information.

Coworkers

A coworker generally does not need access to another employee's medical information.

For example, an employee may receive a modified work schedule as a reasonable accommodation. Coworkers may know that the schedule has changed, but they generally do not need to know the medical reason behind it.

A manager can explain that a workplace arrangement has been approved without revealing the employee's diagnosis or other confidential medical details.

Employees in unrelated departments

Someone working in payroll, accounting, sales, marketing, IT, or another department does not automatically have a right to browse an employee's medical information.

This is especially important when medical information is stored electronically. Access should be restricted to people who have a legitimate reason to use the information.

An employee's ability to access a company system does not, by itself, create a legitimate reason to view another employee's medical records.

Managers who do not need the information

Managers can sometimes receive limited medical information, but they should not automatically receive an employee's complete medical record.

For example, a supervisor may need to know that an employee has a lifting restriction or requires a particular workplace accommodation. The supervisor generally does not need the employee's entire medical history to implement that restriction.

Other employees

An employer should not make an employee's medical information available simply because another employee is curious, works closely with that person, or wants to understand why the employee is absent.

Medical information can remain confidential even when an employee has voluntarily discussed some health information at work.

Who May Need Limited Access to Employee Medical Information?

Confidentiality does not mean that nobody at an organization can ever see medical information.

Certain employees may need limited access to perform their jobs or meet legal obligations.

HR or designated personnel

Human resources personnel may need access to medical documentation when handling reasonable accommodation requests, medical leave, or other legitimate employment matters.

That does not mean HR should have unrestricted access to an employee's entire medical history. Information should be handled confidentially and accessed only when necessary for the relevant employment purpose.

Supervisors and managers

A supervisor may need to know about work restrictions or an approved accommodation.

For example, if an employee cannot lift objects above a certain weight, the manager may need to know about the restriction so work can be assigned appropriately. The manager does not necessarily need to know the employee's diagnosis, treatment history, or other unrelated health information.

First aid and safety personnel

Medical information may sometimes need to be shared with people responsible for providing emergency treatment or assistance.

For example, relevant information may be needed if an employee has a medical condition that could require emergency care at work.

Even in these situations, the information shared should be limited to what is relevant to the emergency or safety issue.

People handling workers' compensation or insurance matters

Medical information may also need to be disclosed for workers' compensation or insurance purposes when permitted or required by applicable law.

The important point is that these situations do not create unrestricted access to an employee's entire medical record.

Does HIPAA Apply to Employee Medical Records?

This is where many people get confused.

HIPAA generally applies to protected health information held by covered healthcare providers, health plans, and certain other covered entities. It does not generally protect employment records held by an employer, even when those records contain health-related information.

For example, suppose you give your employer a doctor's note supporting a leave request. The employer's copy becomes part of the employment record. HIPAA generally does not regulate that employer-held record in the same way it regulates a covered healthcare provider's medical record.

Other laws can still protect that information. In particular, the ADA requires employers to maintain confidentiality of medical information they obtain about applicants and employees.

For more on general medical records rights, see our guide on medical records: what's inside them, who legally owns them, and how to get your copy.

This distinction matters when looking at HIPAA medical records release laws. HIPAA does not mean that every medical document an employer possesses is automatically a HIPAA-protected medical record.

For the broader HIPAA framework, see HHS HIPAA for individuals.

Can an Employer Get Medical Records Directly From Your Doctor?

Generally, your healthcare provider cannot simply send your medical records to your employer because the employer asks for them.

When an employer asks a healthcare provider directly for medical information, the provider generally cannot disclose it without the individual's authorization unless another applicable law permits or requires the disclosure.

There are limited exceptions. Certain circumstances can involve workplace medical surveillance, work-related illness or injury, or occupational safety requirements.

The specific circumstances matter. An employer requesting medical information does not automatically mean a healthcare provider can release an employee's entire medical record.

If you need to formally request your own records, see our guide on medical records request form templates and how to use them.

What About HIPAA Electronic Medical Records?

The same basic distinction applies to medical information stored electronically.

HIPAA electronic medical records can be protected by HIPAA when they are maintained by a covered healthcare provider or health plan. However, electronic employment records held by an employer are generally not covered by HIPAA simply because they contain health information.

For employers, the ADA still requires medical information to be kept confidential and separate from ordinary personnel files. Electronic storage does not eliminate that confidentiality requirement.

In practical terms, an employer should not treat a shared electronic employee database as a reason for unrestricted access to medical information.

For more on accessing your own records digitally, see our guide on how to view your medical records online for free.

What Information Does a Manager Actually Need?

A useful distinction is between medical information and work-related information.

A manager may need to know:

• That an employee has an approved work restriction
• What workplace restriction needs to be followed
• What accommodation has been approved
• When an accommodation or restriction applies

The manager generally does not need to know:

• The employee's complete medical history
• Unrelated diagnoses
• Detailed treatment information
• Medication history unrelated to the workplace issue
• Private information about other medical conditions

The goal is to give the manager enough information to manage the workplace issue without unnecessarily revealing confidential medical details.

What If You Think Your Medical Information Was Shared Improperly?

Start by documenting what happened.

Write down what information was disclosed, who received it, when the disclosure occurred, and how you learned about it. Keep copies of relevant emails, messages, or other documentation.

You can then ask your employer's HR department or designated privacy contact how medical information is stored and who has access to it.

If the concern involves a healthcare provider or health plan and you believe protected health information was improperly disclosed, HIPAA may be relevant. For workplace confidentiality concerns, the ADA and other employment laws may also apply.

The appropriate agency or legal process depends on the circumstances, so the specific details of the disclosure matter.

Conclusion

Employee medical information is not something everyone at a company should be able to access. Coworkers and employees without a legitimate work-related reason should not have unrestricted access to another employee's medical records.

Certain people, such as designated HR personnel, supervisors, first aid staff, or workers' compensation personnel, may have access to limited information when a specific exception or legitimate employment purpose applies.

The key distinction when considering HIPAA medical records release laws is that HIPAA generally governs protected health information held by covered healthcare providers and health plans. Employee medical information maintained by an employer is generally governed by workplace privacy and employment laws rather than HIPAA alone.

Electronic storage does not change that basic principle. HIPAA electronic medical records held by covered healthcare organizations can fall under HIPAA, while electronic employment records held by an employer generally do not become HIPAA-protected simply because they contain medical information.