HIPAA at Work: What It Does (and Does NOT) Protect About Your Medical Information
Everyone seems to invoke HIPAA at work.
"My manager violated HIPAA."
"HR can't ask me that because of HIPAA."
"I don't have to tell my employer about my medical condition because of HIPAA."
As a former HR executive and attorney, I can't tell you how many times I've heard employees—and sometimes managers—use HIPAA as if it's a magic shield that applies to every conversation about health in the workplace.
The reality is much more nuanced.
In fact, most workplace disputes involving medical information have nothing to do with HIPAA at all.
Understanding what HIPAA actually covers—and what it doesn't—can help you protect your rights while avoiding common (and costly) misunderstandings.
First: What Is HIPAA?
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996.
One part of HIPAA—the Privacy Rule—protects certain medical information from being improperly disclosed by covered entities, including:
Health care providers
Health insurance companies
Health plans
Health care clearinghouses
Their business associates
Notice what's missing?
Your employer.
Most employers are not covered entities simply because they employ you.
That means HIPAA usually does not regulate how your employer collects or uses medical information for employment purposes.
That surprises a lot of people.
Myth #1: "My Employer Violated HIPAA."
Usually?
No.
Let's say your manager knows you had surgery because:
you requested FMLA leave,
you submitted ADA documentation,
you requested an accommodation,
or you told them yourself.
That information didn't come from your doctor violating HIPAA.
It came through the employment relationship.
HIPAA generally isn't the law governing that situation.
That doesn't necessarily mean your employer handled the information appropriately.
It just means HIPAA probably isn't the issue.
What Laws Actually Apply?
Depending on the situation, medical information at work may be protected by:
The Americans with Disabilities Act (ADA)
The ADA requires employers to keep employee medical information confidential when it is obtained through disability-related inquiries, medical examinations, or accommodation requests.
That information should generally be maintained in separate confidential medical files—not in your regular personnel file.
Access should be limited to people with a legitimate business need.
The Family and Medical Leave Act (FMLA)
Medical certifications submitted for FMLA leave also require confidentiality.
Managers generally don't get to review every detail of your diagnosis simply because you're taking leave.
State Privacy Laws
Some states provide additional protections for employee medical information that go beyond federal law.
Employer Policies
Many companies have confidentiality policies that require HR and managers to limit who receives sensitive employee information.
Violating company policy isn't necessarily illegal—but it can still create significant workplace problems.
HR Confidentiality Is NOT the Same as HIPAA
This is one of the biggest misconceptions I see.
Employees often assume that because they told HR something, HR legally cannot share it.
That's not always true.
HR may need to share information with:
your manager,
legal counsel,
payroll,
leave administrators,
benefits personnel,
safety personnel,
executives involved in employment decisions,
or outside vendors handling accommodations or leave administration.
The key question isn't:
"Did HR tell someone?"
It's:
"Did HR share information with someone who had a legitimate business need to know?"
Those are very different questions.
Your Diagnosis Is Often Less Important Than Your Restrictions
Another misconception:
Employees frequently worry about revealing a diagnosis.
In many ADA situations, the employer doesn't actually need detailed medical history.
Instead, they need information about:
your functional limitations,
workplace restrictions,
expected duration,
and what accommodations may help you perform the essential functions of your position.
Sometimes your doctor can provide all of that without disclosing highly personal medical details.
More information is not always better.
What Should Managers Know?
Managers usually don't need to know:
your diagnosis,
detailed treatment history,
medications,
or extensive medical records.
They generally only need enough information to:
implement accommodations,
administer leave,
manage scheduling,
or ensure workplace safety when appropriate.
Unfortunately, many organizations overshare internally simply because no one has been properly trained.
When Should You Be Concerned?
There are situations where employers may improperly disclose medical information.
Examples include:
discussing your medical condition with coworkers,
leaving medical paperwork where others can see it,
gossiping about your diagnosis,
storing confidential medical records in general personnel files,
revealing accommodation details without a business reason,
or publicly announcing why you're on leave.
Those situations may violate:
the ADA,
the FMLA,
state law,
company policy,
or all of the above.
But they still aren't automatically HIPAA violations.
Practical Tips for Employees
If you're requesting an accommodation or medical leave:
1. Share only what's necessary.
Don't volunteer your complete medical history unless it's actually required.
2. Keep copies of everything.
Maintain copies of:
accommodation requests,
doctor's certifications,
HR communications,
approvals,
denials,
and emails discussing your medical situation.
Documentation matters.
3. Ask who will receive your information.
It's perfectly reasonable to ask:
"Who will have access to this documentation?"
4. Watch how information is handled.
If sensitive medical information begins circulating among coworkers, that's something to document immediately.
5. Learn which law actually protects you.
Understanding whether your situation involves:
ADA,
FMLA,
state law,
employer policy,
or HIPAA
can dramatically improve how you respond.
The Bottom Line
HIPAA is incredibly important—but it isn't the workplace privacy law many people think it is.
Most disputes involving employee medical information are governed by the ADA, the FMLA, state privacy laws, and employer confidentiality obligations—not HIPAA.
Knowing the difference matters because citing the wrong law can distract from the protections you actually have.
Your medical information deserves to be handled carefully and respectfully.
Just don't assume every workplace privacy issue is automatically a HIPAA violation.
Sometimes the problem isn't that someone violated HIPAA.
It's that they violated your employment rights.
Before You Go…
If you're trying to navigate an ADA accommodation, FMLA leave, or another workplace medical issue, understanding your rights before you act can save you from costly mistakes.
That's exactly why I created ADA & FMLA: The Workplace Rights Reality Check—
This ebook is a practical guide that explains what these laws actually protect, how the interactive process works, what documentation matters, and the mistakes employees make before they ever need leave or accommodations.
And if your workplace situation is already beginning to deteriorate, don't wait until you're blindsided. The AntiHR Exit Strategy System will help you evaluate your options, protect your leverage, document strategically, and prepare for what comes next.
Finally, if you're looking for ongoing education, live Q&A sessions, practical workplace resources, and a community of employees learning how to navigate HR more strategically, consider joining the AntiHR Membership Community.
Members receive a complimentary copy of the AntiHR Documentation Journal, one of the most valuable tools you can have when workplace issues begin to unfold.
Because understanding your rights is important—but knowing how to use them is what protects your career.
For more tips about navigating and escaping difficult HR situations:
Book a Discovery Call Here
Follow me on social media at @theantihrhrlady
Subscribe to my YouTube channel and check out my playlists!
Subscribe to my website for the latest updates and resources
HR is not your enemy, but they are definitely not your friend.
Comments