Does HIPAA apply to employee health records?

HIPAA does not apply to most employee health records an employer holds. Its definition of protected health information excludes employment records held by a covered entity in its role as employer (45 CFR 160.103), and the Department of Health and Human Services (HHS) says the Privacy Rule does not protect employment records, even health-related ones. HIPAA does apply when the record sits with a covered entity or its business associate: for example an on-site clinic or contracted occupational health provider that qualifies as a covered health care provider, or a group health plan.

Where HIPAA stops, OSHA rules on exposed workers’ medical records and the Americans with Disabilities Act (ADA) set the main US federal duties, alongside other federal and state laws, and in the EU the GDPR treats health data as a special category whoever holds it. This is general information, not legal advice.

The answer depends on who holds the record

In its 2002 final rule, HHS said what counts is why the covered entity obtained the information, not what kind it is. Its example: when a provider examines one of its own employees, the fitness-for-duty result is protected health information, and stops being so once, with the employee’s authorization, it is turned over to the provider as employer.

What HIPAA covers, and what it leaves out

Covered entities

Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction. HHS’s covered entities page applies that test to doctors and clinics. Its wellness program guidance is plain: the HIPAA Rules apply to covered entities and business associates, not to employers in their capacity as employers.

The employment records exclusion

Even a covered entity, such as a hospital, holds no protected health information in its employment records as an employer (45 CFR 160.103, paragraph (2)(iii) of the definition). HIPAA does not stop an employer from asking a worker for a doctor’s note or other health information for sick leave, workers’ compensation, wellness programs or health insurance, though the ADA limits what may be asked.

HIPAA controls the other side. If the employer asks the worker’s health care provider directly, and that provider is a covered entity, the provider generally needs the worker’s authorization. The exceptions include disclosures required by law, disclosures under workers’ compensation laws (45 CFR 164.512(l)) and the workplace surveillance route below.

When HIPAA does reach employee health information

On-site clinics that are covered providers

An employer’s own clinic can be a covered provider if it meets the electronic transaction test. A legal entity with covered and non-covered functions can then operate as a hybrid entity by designating its health care components (45 CFR 164.103 and 164.105(a)(2)(iii)(D)). The entity must ensure the clinic does not disclose protected health information to other parts of the company where the Privacy Rule would forbid it between separate entities (164.105(a)(2)(ii)(A)). In its 2002 rule, HHS said a hospital will in most cases need its employee’s authorization to access or use that employee’s medical information for employment purposes.

Contracted occupational health providers

When a covered provider examines workers at the employer’s request, 45 CFR 164.512(b)(1)(v) lets it disclose findings to the employer without the worker’s authorization when all four conditions hold:

1. The care was given at the employer’s request, for workplace medical surveillance or to evaluate a work-related illness or injury.
2. Only findings on that surveillance or that illness or injury are disclosed.
3. The employer needs them to record the illness or injury or carry out surveillance under OSHA (29 CFR parts 1904 to 1928), MSHA (30 CFR parts 50 to 90) or similar state law.
4. The worker gets written notice, or the notice is posted prominently where care is given at the work site.

HHS’s FAQ on employment exams says pre-placement physicals, drug tests and fitness-for-duty exams are generally not performed for these purposes. For them, the provider needs the worker’s authorization unless another provision of the rule allows the disclosure. For contractor crews, see contractor health records.

Group health plans and wellness programs

A group health plan sponsored by the employer is a covered entity, except a self-administered plan with fewer than 50 participants. According to HHS, information from a wellness program offered through the plan is protected health information. Absent the worker’s written authorization, the employer as plan sponsor gets access for plan administration only after amending the plan documents and certifying, among other things, that it will separate plan administration staff and not use the information for employment-related actions.

OSHA: medical records and the injury log

OSHA’s access rule applies to general industry, maritime and construction employers who make, keep, contract for or have access to exposure or medical records of employees exposed to toxic substances or harmful physical agents (29 CFR 1910.1020(b)(1)). An employee medical record is a health status record made or kept by health care personnel, such as exam results, diagnoses and first aid records ((c)(6)(i)). Two duties matter most:

• Retention: at least the duration of employment plus 30 years, unless a specific OSHA standard sets a different period, and with some exceptions ((d)(1), (d)(1)(i)). See how long to keep occupational health records.
• Access: each employee can see their own medical records on request ((e)(2)(ii)(A)), and a designated representative needs the employee’s specific written consent ((e)(2)(ii)(B)). If access cannot be given within 15 working days, the employer must explain the delay within that time ((e)(1)(i)).

The injury log has its own privacy rule: for privacy concern cases, the employer may not enter the employee’s name on the OSHA 300 Log; it writes “privacy case” and keeps a separate, confidential list of case numbers and names (29 CFR 1904.29(b)(6)). The list of such cases is closed ((b)(7), (b)(8)). More in OSHA employee medical records.

ADA: confidential medical files

Title I of the ADA covers employers with 15 or more employees for each working day in each of 20 or more calendar weeks in the current or preceding calendar year (42 U.S.C. 12111(5)(A)). In the ADA, a “covered entity” means an employer, employment agency, labor organization or joint labor-management committee (12111(2)), not a health care provider or plan as in HIPAA.

The EEOC’s regulation requires medical details from post-offer and employee exams and inquiries to be collected and kept on separate forms, in separate medical files, and treated as a confidential medical record (29 CFR 1630.14(b)(1) and (c)(1)). Employee exams must be job-related and consistent with business necessity (1630.14(c)). Three exceptions apply: supervisors and managers may be told about necessary work restrictions and accommodations, first aid and safety personnel may be told, when appropriate, if the disability might require emergency treatment, and government officials investigating compliance receive relevant information on request.

The EEOC’s enforcement guidance adds that the limits on inquiries and exams apply to all employees, not only those with disabilities. What goes in which file: employee health records vs personnel files.

GDPR: no employer exception for health data

The GDPR has no employment records exclusion. Data concerning health is personal data on physical or mental health, including health care, that reveals health status (Article 4(15)). Processing it is prohibited (Article 9(1)) unless a condition applies. Two matter most at work: employment and social protection law, where authorized by EU or member state law or a collective agreement (Article 9(2)(b)), and occupational medicine and the assessment of an employee’s working capacity (Article 9(2)(h)), where the data are processed by or under the responsibility of a professional bound by professional secrecy (Article 9(3)).

For multi-country employers:

• Scope follows the establishment. The GDPR applies to processing in the context of the activities of an establishment in the EU, wherever the processing takes place (Article 3(1)).
• Member states add rules, both further conditions for health data (Article 9(4)) and more specific rules for employee data, including for health and safety at work (Article 88).
• The UK keeps the same structure. Article 9 of the UK GDPR, amended in parts by the Data (Use and Access) Act 2025, also makes health data a special category.

So an audiogram in a US plant’s confidential medical file is outside HIPAA but still under OSHA and the ADA, while the same audiogram at an EU site is special category data under the GDPR.

One access model for every site

A practical design is one access model for every site, with what is shared and kept set locally:

1. Medical details stay with health professionals in one record system only authorized clinicians open.
2. Outcomes travel, diagnoses do not. Managers receive work restrictions and needed accommodations, in line with the ADA’s exception for supervisors and managers; HSE receives fitness-to-work outcomes.
3. Access is logged, so the employer can show who opened a record and when.
4. Retention is set per site: the period the law requires there, and no longer. At EU sites the GDPR allows identifiable data to be kept no longer than the purpose requires (Article 5(1)(e)).

Take a fictional operator whose contracted clinics examine noise-exposed crews in Texas and in the EU. In Texas, the site manager sees a work restriction, such as hearing protection required; at the EU site, national law sets what the manager may receive. In both, the audiograms stay with the clinicians.

MyC is built this way: one employee health record per worker, employees and contractors alike. Authorized health professionals work in the full medical record; HSE, HR and managers see only what their responsibilities require, such as fitness decisions and work restrictions, without medical details. Every access is logged, and MyC supports GDPR and HIPAA compliance. See also EMR vs EHR in occupational health, or book a demo.

Questions

Is a doctor’s note given to HR protected by HIPAA?

Generally not: HHS says the Privacy Rule does not protect employment records, even health-related ones. The ADA’s confidentiality rule and other laws can still apply.

Does HIPAA apply to an on-site employer clinic?

It can, if the clinic transmits health information electronically in connection with a standard HIPAA transaction. The company can then operate as a hybrid entity, and must keep the clinic from disclosing protected health information to other parts of the company where the Privacy Rule would forbid it.

Can an occupational health provider share exam results with the employer?

With the worker’s authorization, yes. Without it, the main route is narrow: surveillance or work-related illness or injury findings from an exam the employer requested, which the employer needs for OSHA, MSHA or similar state law duties, after written notice to the worker. A few other routes exist, such as workers’ compensation laws.

Does the GDPR apply to employee health records?

Yes, at least for processing in the context of an EU establishment. Health data is special category data under Article 9, and processing it needs a condition such as employment law or occupational medicine.

Sources

1. 45 CFR 160.103: Definitions (HIPAA covered entity, protected health information)
2. HHS: Employers and health information in the workplace
3. HHS: Covered entities and business associates
4. HHS, Federal Register, August 14, 2002: Standards for privacy of individually identifiable health information (final modifications)
5. 45 CFR 164.103: Definitions (hybrid entity)
6. 45 CFR 164.105: Organizational requirements (hybrid entities)
7. 45 CFR 164.512: Uses and disclosures for which an authorization or opportunity to agree or object is not required (HIPAA)
8. HHS FAQ: Disclosing findings of pre-employment physicals, drug tests or fitness-for-duty exams to an employer
9. HHS: HIPAA privacy and security and workplace wellness programs
10. 29 CFR 1910.1020: Access to employee exposure and medical records
11. 29 CFR 1904.29: Forms (OSHA injury and illness log, privacy concern cases)
12. 42 U.S.C. 12111: Definitions (ADA Title I)
13. 29 CFR 1630.14: Medical examinations and inquiries specifically permitted (ADA)
14. EEOC enforcement guidance: disability-related inquiries and medical examinations of employees under the ADA
15. Regulation (EU) 2016/679 (GDPR), Articles 3, 4, 5, 9, 35 and 88
16. UK GDPR Article 9: Processing of special categories of personal data

Written by Lisa Bardet, VP Marketing at MyC. Every factual claim in this article is checked against primary sources, such as regulations, regulators and peer-reviewed studies, in three passes before publication, and the sources are listed above.

This article is general information for employers and occupational health teams. It is not legal or medical advice for a specific situation.