You can tell employees that a coworker is out and when they’re expected back, but you cannot tell them the person is on FMLA leave, medical leave, or anything else that signals a health condition. Federal regulations treat every piece of medical information tied to an FMLA request as confidential, and labeling the absence is itself a disclosure the Department of Labor has flagged as potential interference with the employee’s rights.1U.S. Department of Labor. FMLA Frequently Asked Questions The safe rule is to share the operational facts a team needs to keep working, and nothing about why the person is gone.
What You Can Safely Say to the Team
Coworkers need to know two things: who is out, and who is covering the work. A manager can say something like, “Jane is on a leave of absence and is expected back around October 1st. During her absence, Mark will be handling her client accounts.” That gives the team what it needs for planning without revealing anything private.
Keep the phrasing generic. “On leave” or “on a leave of absence” works. No adjective in front of “leave,” no explanation of the reason, no timeframe framed around a medical event. If coworkers press for more, the answer is that the company doesn’t share the reasons for anyone’s leave. That response is true, consistent, and applies equally to everyone, which is exactly what you want.
What Crosses the Line
The disclosures that get employers sued usually aren’t malicious. They come from managers trying to be helpful, sympathetic, or transparent with the team.
Labeling the leave is the most common mistake. Saying someone is on “FMLA leave” or “medical leave” tells everyone within earshot that the absence involves a health condition, and the DOL has warned that sharing or threatening to share health information to discourage FMLA use is prohibited interference.1U.S. Department of Labor. FMLA Frequently Asked Questions The label alone is the disclosure.
Sympathy announcements are the second trap. A manager who tells the team, “Let’s all send Jane good wishes, she’s dealing with a tough health situation,” has just broadcast medical information to the whole department. Well-intentioned, still a breach. The team needs to know who’s covering what, not why someone is gone.
Digital tools carry the same risk and are easier to overlook. A shared calendar entry reading “FMLA Leave — Sarah” broadcasts protected information to everyone with calendar access. The entry should read “Out of Office” or “Leave of Absence” and stop there. Out-of-office auto-replies should avoid any reference to medical leave or FMLA; a plain “I am currently out of the office and expect to return by [date]. For urgent matters, please contact [name] at [email]” does the job. Internal messaging platforms deserve the same discipline. A Slack post saying “Sarah’s out on medical leave again today” is a breach even if everyone on the team already suspects the reason.
Who Inside the Company Can Know More
The regulation behind all of this, 29 C.F.R. § 825.500(g), requires that medical certifications, recertifications, and medical histories tied to FMLA be stored in confidential files separate from the personnel folder, and it identifies a short list of people who can receive limited information.2eCFR. 29 CFR 825.500 – Recordkeeping Requirements
- Supervisors and managers can be told about work restrictions and accommodations the employee needs, for example “no lifting over 25 pounds for six weeks,” but not the underlying medical condition. They can also be told the employee is away and when to expect the return.
- First aid and safety personnel can be informed if the employee’s condition might require emergency treatment at work. The exception is narrow and exists for safety, not curiosity.
- Government officials investigating FMLA compliance must be given relevant records on request.
HR staff and leave administrators who process the paperwork obviously need access. Payroll may need to know whether leave is paid or unpaid. In every case the information stays within the smallest circle possible and never includes details a person doesn’t need for their job.3U.S. Department of Labor. Employers Guide to the Family and Medical Leave Act One practical rule from the DOL: a direct supervisor may not contact the employee’s health care provider to authenticate or clarify a medical certification. That contact goes through HR or a leave administrator.
Coworkers do not appear on this list. Nothing they are told should identify the type of leave or the reason for it.
Intermittent Leave Conversations
Intermittent FMLA leave produces the hardest disclosure situations. When someone is regularly late or absent a few times a month, coworkers notice and start asking questions, and supervisors feel pressure to explain.
A supervisor managing intermittent leave can be told the expected frequency and duration of the absences so they can plan coverage. If an employee is expected to arrive two hours late twice a week, the supervisor needs that. The supervisor still cannot be told what medical condition causes the absences, and cannot relay even the limited information they have to the rest of the team.1U.S. Department of Labor. FMLA Frequently Asked Questions
When coworkers complain about picking up slack, and they will, redirect the conversation toward workload solutions rather than explanations. “I know the schedule changes are frustrating. Let’s figure out how to redistribute the morning tasks” works far better than any vague hint about the absent employee’s situation.
When the Employee Tells Coworkers Themselves
Nothing in the FMLA prevents an employee from telling coworkers about their own medical condition or the reason for their leave. Some people are open about it, and that’s their right. Their voluntary disclosure does not give the employer permission to discuss the same information. Even if the entire office knows because the employee told everyone personally, the employer is still bound by the confidentiality rules and must treat the medical documentation as restricted.
If an employer needs to share medical information with someone outside the permitted categories, the employee would need to provide written authorization. HIPAA’s authorization requirements apply when a health care provider shares individually identifiable health information with an employer.4eCFR. 29 CFR 825.307 – Authentication and Clarification of Medical Certification In practice, don’t assume you can freely repeat medical details just because the employee mentioned them in conversation once.
What Happens If You Get It Wrong
Improper disclosure can support two overlapping claims under the FMLA, and often triggers claims under other statutes as well.
The first is interference. Courts have recognized that breaching the confidentiality of FMLA medical records can constitute interference with the employee’s FMLA rights, even when the employer didn’t block the leave itself.5U.S. Department of Labor. Fact Sheet 77B – Protection for Individuals Under the FMLA The reasoning: if employees know their medical information may be shared around the office, they’ll think twice about requesting leave, and that chilling effect is itself the interference.
The second is retaliation. If the employee can show that the disclosure was a negative action taken because they used FMLA leave, such as a manager sharing a diagnosis in a derogatory way, that fits the definition of prohibited retaliation.5U.S. Department of Labor. Fact Sheet 77B – Protection for Individuals Under the FMLA
Damages are meaningful. A liable employer owes any lost wages, salary, or benefits caused by the violation. If there were no lost wages, for example the employee kept the job but was embarrassed by the disclosure, the employee can recover actual monetary losses up to 12 weeks of wages. The statute adds liquidated damages equal to the combined total of the lost compensation and interest, effectively doubling the award, and the court must order the employer to pay the employee’s attorney’s fees and expert witness costs. An employer can avoid the doubling only by proving to the court that it acted in good faith and had reasonable grounds for believing it wasn’t violating the law, a tough standard when the violation involved sharing someone’s medical details. Courts can also order equitable relief including reinstatement and promotion. The employee has two years from the date of the violation to sue, or three years if the violation was willful.6Office of the Law Revision Counsel. 29 USC 2617 – Enforcement
Confidentiality breaches also rarely stay confined to the FMLA. In Doe v. United States Postal Service, a postal worker disclosed his HIV status to apply for FMLA leave, and after coworkers learned his diagnosis from a supervisor, the D.C. Circuit found that a jury could reasonably conclude that compelling him to reveal his HIV status and then disclosing it violated both the Privacy Act and the Rehabilitation Act.7Justia Law. Doe v. United States Postal Service, 317 F.3d 339 The same facts often support ADA, GINA, or state privacy claims alongside the FMLA count.
Keeping the Information Contained
Most breaches happen because a manager didn’t know the rules, not because anyone acted with bad intent. A few concrete practices reduce the risk substantially.
- Train supervisors on FMLA confidentiality before they need it, not after a leave request lands on their desk. The training must cover what they can and cannot say, and who to call when they’re unsure.
- Give managers approved language for telling the team about an absence. If they don’t have to improvise, they’re far less likely to say something they shouldn’t.
- Audit shared calendars, project management tools, and internal databases so that leave entries don’t include type-of-leave labels visible to unauthorized people.
- Put medical certifications into a separate confidential file immediately, not into the personnel folder with a plan to move them later.
- When a supervisor is told about work restrictions or accommodations, document the communication in writing. If a dispute arises, you’ll want a record of exactly what was disclosed and to whom.
The underlying principle is simple. If someone doesn’t need a piece of medical information to do their job, they shouldn’t have it. When in doubt, share less. Adding a detail later if it turns out to be necessary is easy; undoing a disclosure that already happened is not.