What your employer can ask about your health, and what it must do with the answer

This is the US federal floor. The ADA applies to employers with 15 or more employees; below that, a state fair-employment statute usually takes over, often at a lower headcount. State medical-privacy and sick-leave laws sit on top of it everywhere.

Why "my boss violated HIPAA" is almost always wrong

The Privacy Rule binds covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically in a covered transaction. An employer is none of those. Sponsoring a group health plan does not convert one into a covered entity either — the plan is regulated, the employer is not.

The point is sharper where the employer is a covered entity. A hospital is regulated in everything it does with patients, yet the definition of protected health information at 45 CFR 160.103 carves out "employment records held by a covered entity in its role as employer". The hospital's file on you as a patient is protected. Its file on you as a nurse is not, in the same building.

So the summary is uncomfortable: once a health fact reaches your employer lawfully, HIPAA has nothing further to say about it. It constrains the clinic that might release the record, not the company receiving it — which is why an authorization and a records release control the hand-off. What binds the employer is a different statute with a different shape.

The rule changes twice between the advert and your first day

The ADA does not set one standard for medical questions. It sets three, and which applies depends on where you are in the hiring sequence. Applicants think they are less protected than they are; employees think they are more.

The EEOC's pre-offer guidance defines the prohibited category as any question "likely to elicit information about a disability" — a test about effect, not intent. Current medication is out. So is how many sick days you took last year, though your attendance record is in, because absence has many causes unrelated to disability. Workers' compensation history is out, because it goes straight to the severity of an impairment.

What "job-related and consistent with business necessity" actually requires

Once you are employed, the standard has a definite content, and it is not "the manager would like to know". The EEOC reads it as requiring a reasonable belief, based on objective evidence, either that an employee's ability to perform essential job functions is impaired by a medical condition, or that the employee poses a direct threat because of one. The assessment has to be individual. A diagnosis alone does not supply it.

The agency's worked examples show how narrow that is. An airline may require pilots to report medications that could affect flying. A fire department may not require the same of its clerical staff. A police department may not periodically test officers for HIV, because being HIV-positive is not itself a direct threat. The inquiry tracks the function, not the rank of whoever is asking.

The doctor's note: usually lawful, usually asked for wrongly

Requiring documentation to justify sick leave is permitted, and one of the few places where "we do this for everyone" genuinely does the work. Two independent facts decide whether a demand is sound, and people test only one of them.

Can they ring your doctor?

Not on their own initiative. Your doctor is a covered entity, and releasing your records without your authorisation is the clinic's problem. So the route runs back through you. Under the ADA, the EEOC describes asking the individual "to sign a limited release allowing the employer to submit a list of specific questions" — tied to the limitations and the accommodation at issue. Complete medical records are explicitly not on the table.

FMLA leave has tighter machinery. Where a certification is complete and sufficient, 29 CFR 825.307 says the employer may not request further information from the provider at all. Where it may seek authentication or clarification, the contact must come from a health care provider, an HR professional, a leave administrator or a management official — and "under no circumstances... may the employee's direct supervisor contact the employee's health care provider". That is the line manager after line manager breaks, usually meaning well.

A third statute is in the room. GINA bars employers from requesting genetic information, defined to include family medical history — the thing a provider volunteers without being asked. The regulation at 29 CFR 1635.8 offers a safe harbour: include a warning telling the provider not to supply genetic information, and anything arriving anyway counts as inadvertent. Request letters that omit it turn a routine reply into a problem.

The filing rule nearly every employer breaks

This is the quiet one. The ADA does not merely restrict the asking. It dictates the storage. Medical information "shall be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record" — a separate file, not a tab in the personnel record. Three narrow exceptions: necessary work restrictions to supervisors, emergency needs to first aid and safety staff, and whatever government investigators ask for.

What surprises employers is the reach. The EEOC applies the duty to any medical information obtained, including what an employee volunteered unprompted. There is no exception for the note the employer demanded itself.

What to do when the line has been crossed

Most of these situations are not bad faith. A manager wanted the absence explained and reached for the nearest question. That matters, because the cheapest responses work when the demand was habit rather than design.

Read the handbook first. It is the source of the demand and it is also evidence — what a handbook actually binds covers where that line falls. If your employment contract sets its own certification terms, they sit on top of the statute rather than displacing it.

The asymmetry worth remembering

The rules make a shape that is easy to state and hard to intuit. An employer's freedom to ask is widest at the moment you have least leverage — after the offer, before the start — and narrowest once you are established. Its duty to protect what it learns never varies, and applies in full to information it never asked for.

One working rule follows for both sides. Answer the question that was actually needed and no more; file the answer where nobody deciding your future can read it. A voluntary wellness programme and a demanded sick note look nothing alike on the day. By the time either is a problem they are the same thing: a health fact in the wrong drawer.