Employers and Health Information in the Workplace
This is an explanation of how the HIPAA Privacy Rule applies health information and employers. The target audience is individuals.
Final
Issued by: Office for Civil Rights (OCR)
Employers and Health Information in the Workplace
The Privacy Rule controls how a health plan or a covered health care provider shares your protected health information with an employer.
Employment Records
The Privacy Rule does not protect your employment records, even if the information in those records is health-related. In most cases, the Privacy Rule does not apply to the actions of an employer.
If you work for a health plan or a covered health care provider:
- The Privacy Rule does not apply to your employment records.
- The Rule does protect your medical or health plan records if you are a patient of the provider or a member of the health plan.
Requests from your employer
Your employer can ask you for a doctor’s note or other health information if they need the information for sick leave, workers’ compensation, wellness programs, or health insurance.
However, if your employer asks your health care provider directly for information about you, your provider cannot give your employer the information without your authorization unless other laws require them to do so.
Generally, the Privacy Rule applies to the disclosures made by your health care provider, not the questions your employer may ask.
See 45 C.F.R. §§ 160.103 and 164.512(b)(1)(v), and OCR's Frequently Asked Questions.
For employer issues, contact:
- Department of Labor: (866) 4-USA-DOL
- Equal Employment Opportunity Commission: (800) 669-4000
Health Information Privacy Information in Multiple Languages
HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the guidance@hhs.gov.
DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.