Medical Privacy Rights for Federal Employees
Federal employees often assume that HIPAA protects their medical information at work. That assumption is understandable—but incorrect. HIPAA governs healthcare providers and insurers, not federal agencies acting as employers. The real protection in the federal workplace comes from the Rehabilitation Act of 1973, which incorporates strict confidentiality rules from the Americans with Disabilities Act (ADA).
Understanding this distinction is not academic—it determines whether a legal violation has occurred and what remedies are available.
What the Rehabilitation Act Requires
When a federal agency receives medical information, it takes on clear legal obligations. Whether the information comes through a reasonable accommodation request, FMLA paperwork, or a fitness-for-duty exam, the agency must:
- Keep the information confidential
- Store it separately from the Official Personnel File (OPF)
- Limit access to only those with a legitimate need to know
This is not a best practice—it is a legal requirement. The purpose is to ensure that sensitive health information does not influence employment decisions or workplace treatment inappropriately.
Common—and Often Overlooked—Violations
Many violations occur in subtle, everyday situations. A supervisor casually referencing an employee’s diagnosis to coworkers. HR forwarding medical documentation to a selecting official during a promotion process. Accommodation paperwork being placed in a general personnel file rather than a confidential medical file.
Even more concerning are performance evaluations that reference a medical condition learned through confidential channels. These actions may feel routine within an office—but they can constitute unlawful disclosures under the Rehabilitation Act.
The key takeaway: if medical information is shared beyond a narrow, legally permitted circle, there is a strong possibility that the law has been violated.
The 45-Day Deadline That Controls Everything
Timing is critical. Federal employees have just 45 days from the date they become aware of the improper disclosure to contact an EEO counselor. This deadline is strictly enforced.
Importantly, the law does not require full proof at this stage. The requirement is simply to initiate contact and preserve the claim. Waiting to gather evidence can result in losing the right to pursue the case entirely.
A practical step: document what happened as soon as possible—who disclosed the information, when, and to whom. This record can become essential later.
What Remedies Are Available
If a violation is proven, the Rehabilitation Act allows recovery of compensatory damages for emotional distress and related harm. That recognition matters—improper disclosure of medical information can have lasting professional and personal consequences.
Additionally, the statute includes fee-shifting provisions. If the employee prevails, the agency is responsible for paying attorney’s fees. This structure is designed to make enforcement accessible, even when the employee would otherwise hesitate to pursue a claim.
A Grounded Approach Moving Forward
Experiencing a breach of medical privacy can feel deeply personal and destabilizing. A mindful approach focuses on two things: preserving legal rights and avoiding reactive decisions that could complicate the situation.
Document the facts. Make timely EEO contact. Seek informed guidance. These steps create stability in a moment that often feels anything but stable.
Your medical information belongs to you. Federal law requires your employer to treat it that way—and there are consequences when it does not.
Legal Disclaimer: The information provided in this article is for informational purposes only and should not be construed as legal advice. While I am a federal employment attorney, this post does not create an attorney-client relationship. Every situation is unique, and legal outcomes depend on specific facts and circumstances.