Your Employer’s Obligation to Keep Your Medical Information Confidential
You disclosed a medical condition to HR as part of an accommodation request. Now your supervisor knows. Your coworkers know. The diagnosis you shared in confidence has traveled through the organization. California law requires employers to keep medical information confidential — and when they don’t, the breach is itself a violation.
An employee who requests a disability accommodation, who takes medical leave, or who participates in a fitness-for-duty evaluation necessarily shares medical information with the employer. The information is sensitive — a diagnosis, a treatment plan, a functional limitation — and the employee shares it not because they want to but because the accommodation process requires it.
California law and federal law both impose strict limits on what the employer can do with that information. It must be kept confidential. It must be shared only with those who have a legitimate need to know. And it must be maintained separately from the employee’s general personnel file.
What the law requires
FEHA regulations require that medical information obtained in connection with a disability accommodation request be kept confidential and be disclosed only to persons with a legitimate need to know. The information may be shared with: the employee’s supervisor, to the extent necessary to implement the accommodation; safety personnel, if the condition might require emergency treatment; and government officials investigating compliance with the law.
The federal ADA imposes similar requirements under 42 U.S.C. section 12112(d)(3)(B): medical information obtained through a permitted inquiry must be collected and maintained on separate forms, kept in separate medical files, and treated as confidential.
The obligation is not merely to avoid publishing the information. It is to actively protect it — to restrict access, to store it separately, and to ensure that the people who receive it understand the confidentiality requirement.
How employers violate it
The violations are common and follow predictable patterns.
Sharing the diagnosis with managers who do not need it. An employee requests a schedule modification as an accommodation. HR approves the modification. To implement it, the supervisor needs to know the schedule — not the diagnosis. But HR tells the supervisor the diagnosis: “She has lupus, so she needs a modified schedule.” The supervisor now knows the employee’s medical condition, and the employee did not consent to the disclosure.
Discussing accommodations in front of coworkers. A supervisor announces, in a team meeting or in casual conversation, that the employee has a medical condition and that the schedule change is an accommodation. The information is now public — shared without the employee’s consent, without a legitimate need, and in a manner that stigmatizes the employee.
Leaving medical documentation in accessible files. The employer stores the employee’s medical certification — the doctor’s letter describing the condition and the limitations — in the general personnel file, where it is accessible to anyone with file access. The information should be in a separate, restricted medical file.
Using the information against the employee. The employer learns the employee has a mental health condition through the accommodation process and uses the information to question the employee’s judgment, to remove responsibilities, or to characterize the employee as unreliable. The medical information obtained through the accommodation process has been weaponized.
What this means for employees
An employee who provides medical information as part of an accommodation request, a leave request, or a fitness-for-duty evaluation has a right to expect that the information will be kept confidential. When the employer breaches that confidentiality, the breach may give rise to several claims.
Disability discrimination. If the employer uses the medical information to take adverse action — to demote, to terminate, to deny opportunities — the use of the information is evidence of discriminatory motive. The employer learned about the disability through a confidential process and acted on it.
Violation of FEHA’s confidentiality requirements. The breach of confidentiality is itself a violation of the regulations implementing FEHA’s accommodation provisions. The employee may have a standalone claim for the breach.
Invasion of privacy. Under the California Constitution and common law, the unauthorized disclosure of private medical information may constitute an invasion of privacy — particularly when the disclosure was widespread, when the information was sensitive, and when the employee had a reasonable expectation that it would be kept confidential.
Hostile work environment. If the disclosure leads to coworker commentary, stigmatization, or exclusion based on the medical condition, the resulting atmosphere may constitute a hostile work environment based on disability.
What to do
An employee who learns that their medical information has been shared beyond the people who needed to know should document the breach — who disclosed what, to whom, when, and how — and should evaluate whether the disclosure has led to adverse consequences.
If the information was shared with a supervisor who then changed how they treat the employee, the connection between the disclosure and the adverse treatment is evidence. If the information was shared with coworkers who then stigmatized the employee, the disclosure created the hostile environment.
An employee who is asked to provide medical information for an accommodation request should clarify, in writing, that the information is being provided on the understanding that it will be kept confidential and shared only with those who have a legitimate need to know.
If your employer shared your medical information — your diagnosis, your condition, your treatment — with people who did not need to know it, the disclosure violated your right to confidentiality. The information you provided in confidence was supposed to stay there. When it didn’t, the breach is itself a violation — and any adverse consequences that followed from the disclosure compound it.
This article is general information about California law and is not legal advice. Every situation turns on its particular facts.