In most situations, your employer cannot share your personal information with coworkers. Medical details, genetic information, and family medical history are protected by federal law and must be kept in separate confidential files, with disclosure limited to a short list of people with a real need to know. Other sensitive data, like Social Security numbers and disciplinary records, is not locked down by a single federal statute but is still expected to stay within management. The one major category coworkers are free to discuss is their own pay, which is protected under federal labor law.
Medical Information Your Employer Learns About You
The Americans with Disabilities Act sets the strictest rule most workers will run into. Any medical information your employer obtains — from a hiring physical, a doctor’s note, an accommodation request, or a voluntary wellness program — has to be kept on separate forms in separate medical files, not dropped into the personnel folder that holds your reviews and application.1Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination
The ADA allows only three people or groups to be told about that information, and even then only what they need:
- Supervisors and managers may be informed of necessary work restrictions or accommodations, but not the underlying diagnosis.
- First aid and safety personnel may be told if a condition could require emergency treatment at work.
- Government officials investigating ADA compliance may request relevant records.
Coworkers are not on that list. A manager who tells the team why you’ve been out sick, or who explains to your peers that you have a particular condition, has likely violated federal law.1Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination Curiosity, sympathy, and general concern for your wellbeing are not exceptions. If a coworker needs to know that you cannot lift more than 20 pounds so they can pick up a task, they can be told that restriction — not the reason for it.
Where HIPAA Fits (and Doesn’t)
Many employees assume HIPAA covers everything health-related at work. It usually does not. HIPAA governs health plans and healthcare providers, and the Department of Health and Human Services states it plainly: “The Privacy Rule does not protect your employment records, even if the information in those records is health-related.”2HHS.gov. Employers and Health Information in the Workplace The doctor’s note you handed HR, the accommodation you requested, the diagnosis your supervisor learned about during a leave discussion — those are ADA-protected, not HIPAA-protected. Filing a HIPAA complaint over an employment record will go nowhere; the right route is an EEOC charge.
Genetic Information and Family Medical History
The Genetic Information Nondiscrimination Act makes it illegal for employers to use genetic information in any employment decision. That category is broader than most people realize: it covers your genetic test results, your family members’ genetic tests, and your family’s medical history.3U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008 An employer who asks about a family history of heart disease during a post-hire exam has crossed the line.
Employers cannot request or purchase genetic information, and any genetic data they do acquire must go in a separate medical file. GINA also reaches inadvertent disclosures. If a manager overhears you mention a parent’s illness at lunch, the company still cannot use or repeat that information.4U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination Disclosures are permitted only in a narrow set of situations: at your written request, in response to a court order (limited to what the order specifies), to government investigators, for FMLA certification, and to public health authorities addressing a contagious disease posing an imminent threat to life.5Office of the Law Revision Counsel. 42 U.S. Code 2000ff-5 – Confidentiality of Genetic Information Telling a coworker is not on that list.
FMLA Leave and What Coworkers Can Learn
When you take leave under the Family and Medical Leave Act and turn in medical certifications, those documents get their own layer of protection. Federal regulations require FMLA medical certifications and related medical histories to be kept as confidential medical records in separate files.6eCFR. 29 CFR 825.500 – Recordkeeping Requirements If the certification also contains genetic information, GINA’s rules stack on top.
The three ADA exceptions carry over: supervisors can be told about work restrictions, first aid staff can be told about conditions that might require emergency treatment, and government officials can request records for compliance investigations.6eCFR. 29 CFR 825.500 – Recordkeeping Requirements Your employer cannot tell coworkers the medical reason you are out on FMLA leave.
Non-Medical Personal Information
Employers hold a lot of other sensitive data: Social Security numbers, bank account details for direct deposit, home addresses, immigration documents, and salary information. No single federal statute protects all of it with the force of the ADA or GINA, but employers still face real consequences for careless handling. Unauthorized disclosure of Social Security numbers or financial details can enable identity theft, and many states impose their own safeguards, including limits on displaying full Social Security numbers on internal documents.
Performance evaluations and disciplinary records carry a reasonable expectation of confidentiality as well. Federal law does not classify them as confidential medical records, but most employers treat them as restricted to management with a direct need. Sharing your discipline history or performance problems with coworkers who have no supervisory role can create legal exposure, especially if it feeds a retaliation or hostile work environment claim.
The Information Coworkers Can Freely Discuss: Pay
Salary trips up both sides. While your employer generally cannot broadcast your compensation to coworkers, you have a federally protected right to discuss your own wages with fellow employees. Section 7 of the National Labor Relations Act protects “concerted activities for the purpose of collective bargaining or other mutual aid or protection,” and the NLRB has long held that talking about pay falls within it.7Office of the Law Revision Counsel. 29 U.S. Code 157 – Right of Employees as to Organization, Collective Bargaining
Any employer policy that forbids you from discussing your pay with coworkers, or requires permission before you do so, is unlawful. So is a policy vague enough to chill those conversations. An employer that punishes, threatens, interrogates, or surveils you over a pay conversation has committed an unfair labor practice, and you can file a charge with the NLRB.8National Labor Relations Board. Your Right to Discuss Wages The protection applies whether or not you belong to a union, and it covers face-to-face conversations, phone calls, and written messages.
Legitimate Reasons Information May Be Shared
Some sharing is permitted, but every allowed disclosure has to serve a specific legitimate purpose and include only the minimum necessary information. A manager scheduling around your work restrictions can be told what those restrictions are, without the diagnosis. HR staff can access personal data to administer benefits or process payroll. First aid staff can be told enough to respond if you have, say, a severe allergy that requires an epinephrine auto-injector.9U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees Under the ADA You can also give written consent authorizing a specific disclosure for a specific purpose. Blanket consent language buried in new-hire paperwork is worth reading carefully before you sign.
What to Do If Your Employer Already Shared Something They Shouldn’t Have
The strength of any claim comes down to the evidence you gather early.
Write It Down Immediately
Note exactly what was disclosed, when, where, and to whom. A contemporaneous written account, made the same day, carries far more weight than a later recollection. Save emails, texts, chat messages, and internal memos that contain or reference the disclosed information. If coworkers witnessed a verbal disclosure, list their names. Keep it factual.
Complain Internally, in Writing
Check your handbook for the privacy and confidentiality reporting procedure, then file a written complaint with HR that plainly states what was shared, by whom, with whom, and when. Keep a copy. This creates an official record and puts the company on notice to investigate. If the response is inadequate, the complaint becomes part of the paper trail for a federal charge.
File an EEOC Charge Within the Deadline
For violations involving medical information (ADA) or genetic information (GINA), you can file a charge of discrimination with the EEOC, which will investigate and may attempt mediation.4U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination The deadline is 180 calendar days from the violation, extended to 300 days if you live in a state or locality with its own agency enforcing a comparable law.10U.S. Equal Employment Opportunity Commission. How to File a Charge of Employment Discrimination Most states have such an agency, but confirm before assuming you have the longer window. Miss the deadline and the claim is gone, no matter how strong the evidence. Federal employees have only 45 days to contact an EEO Counselor.
Know What You Can Recover
Successful claims can recover compensatory damages for out-of-pocket costs and emotional harm, and punitive damages where the employer’s conduct was especially reckless or malicious.11U.S. Equal Employment Opportunity Commission. Remedies for Employment Discrimination Federal law caps the combined total of compensatory and punitive damages based on employer size:12Office of the Law Revision Counsel. 42 U.S. Code 1981a – Damages in Cases of Intentional Discrimination in Employment
- 15 to 100 employees: $50,000
- 101 to 200 employees: $100,000
- 201 to 500 employees: $200,000
- More than 500 employees: $300,000
The caps apply to federal ADA and GINA claims. They do not limit back pay or front pay, and they do not apply to state law claims, which sometimes allow larger recoveries. Some employees may also have state common-law claims, such as public disclosure of private facts, that carry their own separate damages. Talking with an employment attorney before choosing which claims to file is the most useful move at that stage.