FMLA Leave and Employee Privacy Rights: A Legal Guide

Family and Medical Leave Act (FMLA) requests often require employers to balance legitimate administrative needs with an employee’s right to medical privacy. Mishandling sensitive information can create legal exposure and undermine workplace trust.

FMLA leave and employee privacy rights intersect when medical certifications, leave notices, and return-to-work documentation are collected or shared. Clear confidentiality practices help employers administer leave lawfully while respecting personal health information.

Understanding FMLA Leave and Employee Privacy Rights

The Family and Medical Leave Act (FMLA) allows eligible employees of covered employers to take unpaid, job-protected leave for qualifying family and medical reasons. Covered employers must generally continue group health insurance coverage during approved FMLA leave.

Employee privacy is closely connected to leave administration because an employee may need to disclose medical information to support a request. Employers may seek limited information through proper certification procedures, but they are not entitled to unrestricted access to an employee’s diagnosis or medical history.

FMLA leave and employee privacy rights require employers to handle medical details carefully, limit disclosure, and use information only for legitimate leave-related purposes. Privacy obligations may also arise under the Americans with Disabilities Act, the Genetic Information Nondiscrimination Act, state laws, and employer policies.

Medical Information Employers May Request for FMLA Leave

An employer may request medical certification supporting an employee’s need for FMLA leave. The certification may confirm that the employee or covered family member has a serious health condition and provide information necessary to establish eligibility.

Permissible information includes the date the condition began, its probable duration, relevant medical facts, and whether inpatient care, continuing treatment, intermittent leave, or a reduced schedule is medically necessary. Employers may use the Department of Labor’s certification forms or seek equivalent documentation.

For an employee’s own condition, the provider may address inability to perform essential job functions. For family-care leave, certification may explain the employee’s need to provide care and estimate the frequency and duration of absences.

FMLA leave and employee privacy rights limit requests to information relevant to the leave determination. Employers generally may not demand complete medical records, a diagnosis beyond what certification requires, or genetic information.

Confidential Handling of FMLA Medical Records

Employers must treat medical certifications, diagnoses, and other health-related materials obtained for FMLA purposes as confidential records. Sound FMLA leave and employee privacy rights practices limit collection to information needed to verify eligibility and administer leave.

FMLA medical records should be maintained separately from an employee’s regular personnel file. Separate storage reduces unnecessary exposure and helps employers comply with related confidentiality requirements under the Americans with Disabilities Act and other applicable laws.

Access should be restricted to staff with a legitimate administrative need, such as designated human resources personnel or leave administrators. Supervisors generally may receive only limited work-related information, including necessary restrictions or accommodation-related guidance.

Electronic records require comparable safeguards, including access controls and secure systems. Employers should also establish procedures for handling, retaining, and disposing of medical information in accordance with applicable federal, state, and record-retention requirements.

Separate Storage Requirements for Medical Records

Employers should maintain FMLA medical certifications, recertifications, and related health records in files separate from an employee’s regular personnel file. These documents should not be placed with performance evaluations, disciplinary records, or routine employment paperwork.

Federal FMLA regulations require records and documents relating to medical certifications, recertifications, and employee medical histories to be maintained as confidential medical records. The information must also be kept in accordance with applicable confidentiality requirements under the Americans with Disabilities Act.

Separate storage helps limit unnecessary exposure to sensitive diagnoses, treatment details, and medical restrictions. Employers may use a secure paper file or a restricted electronic system, provided access is limited to individuals with a legitimate need to administer leave or comply with legal obligations.

This practice supports FMLA leave and employee privacy rights by reducing the risk that medical information will be viewed or used by supervisors, coworkers, or others who do not need it for their job duties.

Limited Access to FMLA-Related Health Information

Access to FMLA-related health information should be limited to personnel with a legitimate need to administer leave, maintain required records, or address workplace restrictions. Broad internal disclosure is inconsistent with the privacy protections surrounding medical information.

Human resources staff or designated leave administrators may review medical certifications to determine eligibility and certification sufficiency. Supervisors generally need only information about approved leave, expected absences, work restrictions, or necessary accommodations—not an employee’s diagnosis or detailed medical history.

Employers should use role-based access controls for electronic files and restrict physical-file access to authorized personnel. Employees handling these records should understand that FMLA leave and employee privacy rights limit casual discussions and unnecessary sharing of medical details.

When information must be shared for operational reasons, employers should disclose only the minimum necessary facts. For example, a manager may be told that an employee cannot lift above a stated limit, without being told the condition causing that restriction.

Confidentiality Under the ADA and Other Laws

The Americans with Disabilities Act (ADA) requires employers to keep medical information obtained from employees confidential, including information gathered during FMLA certification or leave administration when it relates to a disability.

ADA-covered medical information must generally be stored separately from regular personnel files. Access should be limited to personnel with a legitimate need to know, such as designated human resources staff administering leave or accommodations.

Supervisors may be told about necessary work restrictions or accommodations, but they ordinarily do not need an employee’s diagnosis or detailed medical history. Safety personnel may receive limited information when emergency treatment could be necessary.

Other laws may also impose confidentiality duties. For example, the Genetic Information Nondiscrimination Act restricts disclosure of genetic information, while state privacy and medical-record laws may provide broader protections. Sound FMLA leave and employee privacy rights practices account for all applicable requirements.

Communicating With Health Care Providers

Employers may contact an employee’s health care provider to authenticate or clarify a medical certification for FMLA leave, but only after giving the employee an opportunity to correct incomplete or insufficient information. The employer may not seek information beyond the certification’s permitted scope.

Authentication confirms that the provider completed or authorized the form. Clarification addresses understandable issues, such as illegible handwriting or ambiguous responses. Under FMLA regulations, contact should generally be made by a human resources professional, leave administrator, or management official—not the employee’s direct supervisor.

A health care provider may disclose information only as permitted by applicable privacy laws and any required employee authorization. Employers should avoid requesting diagnoses, detailed treatment records, or unrelated medical history when administering FMLA leave and employee privacy rights.

When questions remain unresolved, an employer may seek a second medical opinion at its own expense, subject to FMLA rules. Communications should be documented carefully and limited to determining whether the employee qualifies for protected leave.

Privacy Rules for Employee Notice and Leave Requests

Employees requesting FMLA leave need not disclose a diagnosis to their supervisor or provide extensive medical details. They must give enough information for the employer to determine whether the absence may qualify for FMLA protection.

Employers may require employees to follow ordinary notice procedures, such as contacting a designated leave administrator. For foreseeable leave, employees generally must provide 30 days’ notice when practicable; otherwise, notice should be given as soon as practicable.

Appropriate notice may include information such as:

• The employee cannot perform job functions due to a serious health condition.
• A family member requires care.
• The absence involves pregnancy, hospitalization, or ongoing treatment.
• The employee needs leave for a qualifying military-related reason.

In FMLA leave and employee privacy rights matters, employers should limit requests to information needed for eligibility and certification. Supervisors should avoid probing questions about diagnoses, treatment details, or unrelated health history, and employees should direct medical documentation through confidential leave-administration channels.

Sharing FMLA Leave Information With Managers and Coworkers

Employers should disclose only the information managers need to administer leave, maintain operations, or provide reasonable workplace support. Under FMLA leave and employee privacy rights principles, medical diagnoses and detailed treatment information should remain confidential.

Supervisors may generally be told:

• That the employee is approved for FMLA leave;
• The anticipated duration or schedule of the absence;
• Any work restrictions or necessary accommodations upon return.

Coworkers do not have a right to know why an employee is absent. When questions arise, employers may state that the employee is unavailable or on approved leave, without identifying FMLA status or discussing medical circumstances.

Leave administrators should also limit internal communications to authorized personnel. Emails, scheduling records, and coverage discussions should avoid unnecessary health details, reducing the risk of improper disclosure while allowing the organization to manage staffing needs.

Information Supervisors May Receive

Supervisors may receive only the information needed to manage an employee’s absence and work responsibilities. They generally do not need the employee’s diagnosis, treatment details, or other medical facts supporting an FMLA request.

Appropriate information may include:

• The approved leave dates or anticipated duration;
• Whether the leave is continuous, intermittent, or reduced-schedule leave;
• Necessary scheduling restrictions or work-related limitations;
• The expected return-to-work date, when known.

Under FMLA leave and employee privacy rights principles, human resources or another designated leave administrator should retain medical certifications and disclose limited operational information to supervisors. Supervisors should use that information solely for staffing, scheduling, and accommodation-related decisions.

If a supervisor needs clarification about an employee’s work restrictions, the employer should ordinarily direct questions through HR or the designated administrator rather than asking the employee for private medical details.

Responding to Coworker Questions About an Employee’s Absence

Coworkers may notice an employee’s absence and ask why the person is away or when they will return. Employers should not disclose medical details, an FMLA request, diagnosis, treatment, or family circumstances without the employee’s authorization.

Appropriate responses should remain neutral and limited to operational needs. For example, a manager may state that the employee is unavailable or on approved leave, if necessary, without identifying the type of leave or its reason.

• “The employee is currently unavailable.”
• “We are managing coverage for the absence.”
• “Please direct work-related questions to the designated contact.”

Under FMLA leave and employee privacy rights principles, managers should redirect questions about medical conditions or anticipated return dates to Human Resources. Even apparently harmless disclosures can reveal protected health information or encourage workplace speculation.

Supervisors should also avoid discussing an absent employee’s situation in team meetings, emails, or informal conversations. Work should be reassigned based on business needs, while communications remain focused on duties, deadlines, and available support.

Protecting Privacy During Leave Administration

Leave administration should use the minimum medical information necessary to determine eligibility, designate leave, and manage scheduling. Employers should limit internal discussions to those with a legitimate business need to know.

Human resources staff should keep medical certifications, diagnosis-related details, and recertification records separate from personnel files. Electronic records should be protected through role-based access controls, secure systems, and appropriate retention practices.

Supervisors generally need only practical information, such as approved leave dates, work restrictions, or anticipated return dates. They should not receive an employee’s diagnosis or detailed medical history unless disclosure is permitted and necessary.

Consistent procedures help support FMLA leave and employee privacy rights. Employers should train leave administrators to avoid unnecessary questions, disclose information only as authorized, and document leave decisions without placing confidential health details in routine workplace communications.

Fitness-for-Duty Certifications and Return-to-Work Privacy

An employer may require a fitness-for-duty certification when an employee returns from FMLA leave taken for the employee’s own serious health condition. The employer must have provided notice of this requirement with the FMLA designation notice.

The certification may confirm only whether the employee can resume work. If the employer gave the employee a list of essential job functions when leave was designated, the health care provider may address the employee’s ability to perform those functions.

For FMLA leave and employee privacy rights, employers should not seek unrelated diagnoses, treatment details, or broader medical records through a return-to-work certification. Any medical documentation received must be maintained as a confidential medical record, separate from personnel files.

Employers may contact the health care provider to authenticate or clarify a certification, subject to FMLA rules. Direct supervisors generally should not contact providers, and employees returning with medical restrictions may require an individualized assessment under the ADA.

Common Employer Privacy Mistakes During FMLA Leave

Employers may violate privacy obligations by requesting more medical detail than an FMLA certification requires. Certification forms generally support verification of a serious health condition and leave needs, not unrestricted disclosure of diagnoses, treatment records, or unrelated health history.

Another frequent error is placing medical certifications, doctor’s notes, or fitness-for-duty documents in an employee’s regular personnel file. FMLA-related medical information should be maintained separately and accessible only to personnel with a legitimate business need.

Privacy problems also arise when supervisors disclose an employee’s condition to coworkers or discuss leave reasons openly. Managers may receive limited information needed to administer leave or workplace restrictions, but they should not share medical details unnecessarily.

Employers can also mishandle FMLA leave and employee privacy rights by contacting health care providers directly without following applicable certification-authentication rules. Human resources or another authorized representative—not the employee’s direct supervisor—should generally handle permissible provider communications.

Protecting Privacy While Managing FMLA Leave Lawfully

Employers should collect only the medical information needed to determine FMLA eligibility and administer leave. Requests should follow the certification process and avoid unnecessary diagnoses, treatment details, or broad medical inquiries unrelated to the leave request.

FMLA medical certifications and related health records should be kept in files separate from regular personnel records. Access should be limited to staff with a legitimate administrative need, such as designated human resources personnel.

Supervisors may receive information necessary to manage scheduling, restrictions, or return-to-work arrangements, but they generally should not receive an employee’s diagnosis. Coworkers should be told only that the employee is unavailable or on approved leave.

Consistent procedures help employers respect FMLA leave and employee privacy rights while meeting legal obligations. Training managers, documenting access decisions, and coordinating FMLA practices with ADA confidentiality requirements can reduce improper disclosures.