May an employer access employees’ medical information already in its possession for the purpose of pre-pandemic planning?

The Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules only covers certain health care providers, health care clearinghouses, and health plans.  The Rule generally does not apply to the conduct of employers and, thus should not affect employer access to or use of medical information in its possession.  Even if an employer is a sponsor of a health plan or a provider of health care, employment records held in its role as an employer are not protected by the Privacy Rule.  The requirements of the Rule should be considered if an issue arises in regard to the conduct of employer-sponsored health plans.

The Americans with Disabilities Act (ADA) requires employers to keep medical information about employees confidential.  Specifically, the ADA requires that employers keep employee medical information in separate files apart from personnel records and prohibits disclosure (which would include accessing the information).  An employer may share otherwise confidential medical information with supervisors and managers where necessary to provide a requested accommodation or to meet an employee’s work restrictions, or with first aid and safety personnel if an employee would need emergency treatment or assistance because of a medical condition.  (See the U.S. Equal Employment Opportunity Commission’s publication entitled, The ADA: A Primer for Small Business, for additional information.) 

Note: As an overall matter, employers should be guided in their relationship with their employees by federal, state, and local employment law, and by the company-specific application of these laws as reflected in employee handbooks, manuals, and contracts (including bargaining agreements).

Not all of the employment laws referenced apply to all employers or all employees, particularly state and local government agencies.  For information on whether a particular employer or employee is covered by a law, please use the links provided for more detailed information.  This information is not intended for federal agencies or federal employees -- they should contact the U.S. Office of Personnel Management (OPM) for guidance.

Last Reviewed: 09/01/2011

• For the purpose of estimating pandemic absenteeism levels, may employers obtain medical information about employees’ general health status to identify those employees who may be at a greater risk of contracting pandemic influenza?
• May employers ask employees if they have children or other family members for whom they may need to take care of in the event of a pandemic (for example, if schools were closed)? May they be asked if they have someone else who can take care of these family members? May this information be shared with supervisors and managers?

• Workplace Questions
  • Equal Employment Opportunities
    • Privacy Issues