Fitness-for-Duty Evaluations: A HIPAA Compliance Guide for Employers

Understand When HIPAA Applies to Fitness-for-Duty Records

HIPAA does not generally protect medical information once an employer receives and maintains it as an employment record. Instead, HIPAA primarily regulates covered entities, such as health plans and certain health care providers, and their business associates. A provider’s copy of an evaluation may be protected health information (PHI), even when the employer’s copy is an employment record.

This distinction depends on the capacity in which an organization holds the information. For example, a health care provider that performs an evaluation may be a HIPAA covered entity, while the employer generally is not covered by HIPAA just because it receives health information. If a provider performs services on behalf of a covered entity, a business associate agreement may be required; it is not automatically required for every provider that conducts an employer-requested evaluation.

HIPAA may also apply to a group health plan that is a covered entity. Employers that administer a health plan should keep plan information separate from employment records and limit access to plan information as required by HIPAA.

Obtain Authorization Before Disclosing Evaluation Results

When an employer asks a HIPAA-covered provider to disclose fitness-for-duty results, the provider generally needs the employee’s valid written authorization for disclosure unless a specific legal exception applies. The authorization should identify what information may be disclosed, who may receive it, the purpose of disclosure, and when the authorization expires. Employers should request only information relevant to the work decision, such as whether the employee can perform specified duties or needs restrictions, rather than a full medical history.

Without authorization or an applicable exception, a provider generally cannot share an employee’s PHI directly with the employer. The employer may instead ask the employee to provide appropriate documentation, subject to other applicable laws, including the ADA and FMLA.

Apply Exceptions for Workplace Medical Surveillance

A narrow HIPAA exception may permit a covered provider to disclose PHI to an employer without authorization for workplace medical surveillance or evaluation of a work-related illness or injury. The service must be provided at the employer’s request or as part of the employer’s workforce, and the employer must have a duty under OSHA, MSHA, or similar state law to keep records on or act on the information. The disclosure is limited to the information the employer needs to meet that legal obligation—not an unrestricted release of the employee’s medical record.

The provider must give the employee written notice that the information will be disclosed to the employer. A routine fitness-for-duty exam does not qualify for this exception simply because the employer requested it; the specific legal and workplace-surveillance conditions must be met.

Protect Employee Medical Information

Even when HIPAA does not govern an employer’s employment records, other laws may require confidentiality. The ADA requires employers to keep employee medical information confidential and separate from ordinary personnel files, with limited access for specified purposes. Employers should restrict access to people who need the information for a legitimate workplace reason, such as implementing restrictions or arranging accommodations, and avoid circulating diagnostic details unnecessarily.

Use secure storage and controlled access for evaluation results, certifications, and related communications. Establish a clear process for receiving medical information, documenting work restrictions, and retaining records under applicable laws and policies.

Ensure ADA Medical Exams Are Job-Related

For current employees, the ADA generally allows disability-related inquiries or medical examinations only when they are job-related and consistent with business necessity. This standard may be met when objective evidence gives the employer a reasonable belief that a medical condition may impair the employee’s ability to perform essential job functions or may create a direct threat to the employee or others.

Make the evaluation specific to the job concern. Provide the evaluator with accurate essential functions and ask for information about the employee’s ability to perform those functions, any relevant restrictions, and possible accommodations. Avoid broad or routine medical examinations that are not supported by a job-related need.

The ADA’s business necessity standard does not eliminate the duty to consider reasonable accommodation. If the evaluation identifies restrictions, discuss whether the employee can perform essential functions with an accommodation before making an employment decision.

Follow FMLA Fitness-for-Duty Certification Rules

After FMLA leave for an employee’s own serious health condition, an employer may require fitness-for-duty certification as a condition of restoring the employee if it has a uniformly applied policy or practice for similarly situated employees. The certification may address only the health condition that caused the FMLA leave.

Tell the employee about the certification requirement in the FMLA designation notice. If you require the certification to address the employee’s ability to perform essential job functions, provide the employee with a list of those functions by the time you give the notice. The employer may delay restoration until a properly required certification is provided, but it may not require second or third opinions for an FMLA fitness-for-duty certification.

For intermittent or reduced-schedule FMLA leave, an employer generally may not require certification after every absence. If reasonable safety concerns exist, the employer may require certification up to once every 30 days, limited to the condition that caused the leave. Apply the ADA’s job-related and business-necessity requirements separately when requesting a medical examination.

In practice, distinguish provider-held PHI from employer-held employment records, obtain written authorization before requesting a provider’s disclosure unless a narrow exception applies, and limit evaluations and records to legitimate job-related needs. Apply the ADA’s business necessity standard and follow FMLA notice and certification requirements whenever they govern.

FAQs

Does HIPAA protect employee medical records held by an employer?

Generally, no. HIPAA does not usually protect an employer’s employment records, even when they contain health information. A provider’s or health plan’s copy may still be protected PHI, and other laws such as the ADA may require the employer to keep medical information confidential and separate from personnel records.

Can a provider share fitness-for-duty results with an employer without authorization?

Usually not, unless a specific legal exception applies. One narrow exception may allow disclosure for workplace medical surveillance or evaluation of a work-related illness or injury when the legal requirements are met, the employer has a duty under OSHA, MSHA, or similar state law, and the employee receives the required notice.

When can an employer require a fitness-for-duty evaluation under the ADA?

For a current employee, an employer may require a medical examination or disability-related inquiry when it is job-related and consistent with business necessity. This may apply when objective evidence supports a reasonable belief that a medical condition could impair essential job functions or create a direct threat. The examination should focus on the specific work-related concern.

Can an employer require fitness-for-duty certification after FMLA leave?

Yes, after FMLA leave for the employee’s own serious health condition, if the employer has a uniformly applied policy or practice for similarly situated employees. The employer must give the required notice, and any certification addressing essential functions must be supported by a list of those functions. Special limits apply to intermittent or reduced-schedule leave.