1. Introduction

Confidentiality of employee health data is the legal principle that protects medical information relating to employees from unauthorized collection, access, use, disclosure, or misuse by employers, human-resource departments, insurance providers, occupational-health professionals, and other third parties.

Employee health data may include:

Medical diagnoses, prescriptions, and treatment records.

Physical and mental health information.

Disability status and medical fitness certificates.

Pregnancy-related information and reproductive health records.

Genetic information, biometric health measurements, and laboratory results.

Sick-leave records, workplace injury reports, and occupational-health assessments.

Health information generated through wearable devices or workplace wellness programmes.

The central legal question is how an employer can protect workplace safety and administer employment while respecting an employee's privacy, dignity, and control over sensitive medical information.

The legal framework differs across jurisdictions. In India, constitutional privacy principles, applicable data-protection legislation, employment laws, and sector-specific rules may all be relevant. Other jurisdictions, particularly the United States, the United Kingdom, and the European Union, have additional statutory protections.

2. Meaning and scope of confidentiality

Confidentiality means that health information should be accessed and disclosed only for a legitimate, lawful, and appropriately limited purpose.

It is closely related to, but distinct from, three other concepts:

For example, an employer may legitimately need to know whether an employee is medically fit to perform a safety-critical task. That does not automatically entitle the employer to receive the employee's complete medical history, diagnosis, or prescription records.

The principle of data minimisation requires collecting and sharing only the information reasonably necessary for the stated purpose, subject to applicable law.

3. Legal framework in India

A. Constitutional protection of privacy

Article 21 of the Constitution of India protects life and personal liberty. The Supreme Court has recognised privacy as a fundamental right, including the protection of personal information and bodily autonomy.

This principle is particularly important when an employer is a government authority or when state action is involved. Its application to private employers requires consideration of the relevant statutory and legal framework.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act), establishes a framework for processing digital personal data. Medical information that identifies, or can be linked to, an individual may fall within its scope when the Act applies.

Important considerations include:

Lawful grounds for processing personal data.

Notice and consent requirements, where applicable.

Obligations concerning data security and prevention of breaches.

Restrictions and conditions relating to disclosure and processing.

Rights and remedies available under the applicable provisions.

Statutory exemptions, including any that may be relevant to employment-related processing.

Important qualification: The DPDP Act does not simply reproduce the GDPR's separate category of “special-category health data.” Its commencement and the applicability of particular provisions must be checked against the relevant government notifications and rules in force on the date of the conduct.

C. Information Technology Act, 2000 and SPDI Rules, 2011

The Information Technology Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, have historically provided protections for specified sensitive personal information, including medical records and history, subject to their scope and applicability.

Relevant issues include:

Consent and notice requirements under applicable provisions.

Restrictions on disclosure to third parties.

Reasonable security practices.

Liability for negligent handling of protected information.

The relationship between this framework and the DPDP Act must be assessed under the relevant commencement, amendment, and repeal provisions rather than assuming that all earlier requirements continue unchanged.

D. Employment and occupational-safety legislation

Additional obligations may arise under applicable employment, disability, occupational-safety, social-security, and sector-specific laws.

For example, medical examinations may be required for certain hazardous occupations, while disability law may require reasonable accommodation and prohibit specified forms of discrimination. A statutory requirement for an examination does not necessarily authorize unrestricted disclosure of all resulting medical information.

4. Important judicial decisions and case laws

The following decisions establish principles relevant to employee medical confidentiality, medical privacy, compelled examinations, and the permissible disclosure of health information.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: The case concerned whether privacy is a constitutionally protected right. A nine-judge Constitution Bench considered the constitutional status and scope of privacy.

Judgment: The Court unanimously recognised privacy as a fundamental right protected by the Constitution, including under Article 21. It recognised informational privacy as an important dimension of the right.

Legal principles:

Personal medical information attracts significant privacy protection.

Intrusions into constitutionally protected privacy must satisfy the applicable constitutional requirements.

Restrictions must have a legal basis and legitimate purpose, and satisfy proportionality where that test applies.

Privacy is not absolute, but an intrusion cannot be justified merely because it is administratively convenient.

Application to employee health data: A public-sector employer cannot ordinarily justify indiscriminate medical-data collection simply by invoking managerial authority. A legitimate purpose, appropriate legal authority, and proportionate measures are important.

For private employers, the judgment supplies a foundational constitutional privacy principle, while the precise cause of action depends on the relevant statutes and legal relationship.

Source:

Indian Kanoon

Case 2: Mr. X v. Hospital Z (1998)

Supreme Court of India · (1998) 8 SCC 296

Facts: A hospital disclosed a patient's HIV-positive status in circumstances involving a proposed marriage. The patient alleged that the disclosure violated medical confidentiality and privacy.

Judgment: The Court upheld the disclosure in the circumstances of that case because it considered the protection of an identifiable person from a serious health risk to outweigh the patient's confidentiality claim.

Legal principles:

Medical confidentiality is a fundamental professional obligation, but it is not absolute.

Disclosure may be justified in exceptional circumstances involving a sufficiently serious risk to another person or another legally recognised public interest.

A confidentiality exception must be considered in light of the particular facts and applicable law.

Application to employee health data: An employer should not disclose an employee's diagnosis to colleagues merely because the employer considers it useful. Where a genuine workplace health or safety risk exists, any disclosure must be legally justified and limited to what is necessary to address that risk.

Important qualification: This judgment does not create a general licence for employers to disclose HIV status or other medical conditions. Its reasoning must be read narrowly and in the context of the facts.

Indian Kanoon+1

Case 3: Sharda v. Dharmpal (2003)

Supreme Court of India · (2003) 4 SCC 493

Facts: In matrimonial proceedings, the Court considered whether a party could be directed to undergo a medical examination concerning an alleged mental-health condition.

Judgment: The Court recognised that a court could direct a medical examination in appropriate circumstances, but emphasised that the power should be exercised where there was a strong prima facie case supported by sufficient material.

Legal principles:

Privacy does not automatically defeat every lawful request for medical examination.

Compelled examinations require proper justification.

A decision to intrude into medical privacy must be assessed in the relevant legal and evidentiary context.

Application to employee health data: This decision is relevant by analogy when considering compulsory workplace medical examinations. It does not give every employer the same powers as a court. Any employer-directed examination must have a valid legal or contractual basis, comply with applicable employment protections, and be reasonably connected to the job or a genuine safety requirement.

Indian Kanoon+1

Case 4: Doe v. District of Columbia (2003)

U.S. Court of Appeals for the District of Columbia Circuit · 2003

Facts and issue: The litigation involved the disclosure of an employee's private medical information and the interaction between federal employee protections and the medical-confidentiality provisions of the Americans with Disabilities Act (ADA).

Legal principle: The ADA contains provisions restricting employer medical inquiries and requiring medical information obtained under specified employment-related exceptions to be maintained as a confidential record, subject to statutory exceptions.

Application: Employers should segregate medical records from ordinary personnel files, limit access to authorised staff, and disclose medical information only within the applicable legal exceptions.

This is particularly relevant to organisations operating in the United States, but the ADA does not automatically govern employment relationships in India.

D.C. Circuit Court

Case 5: Byrne v. Avery Center for Obstetrics & Gynecology, P.C. (2014)

Supreme Court of Connecticut · 2014

Facts: A patient alleged that a healthcare provider improperly disclosed confidential medical records while responding to a subpoena.

Judgment: The Connecticut Supreme Court held that HIPAA did not automatically pre-empt the patient's state-law negligence claims in the circumstances considered. HIPAA standards could inform the standard of care in assessing the alleged improper disclosure.

Legal principle: Compliance with federal privacy legislation does not necessarily eliminate other legal duties or potential liability under applicable state law.

Application to employee health data: An employer, occupational-health provider, or medical contractor may face more than one source of legal obligations. Contractual confidentiality, professional duties, data-protection law, and applicable negligence principles may operate alongside one another.

This is a US state-law decision, not a binding precedent in India.

Justia Law

5. International legal framework

A. European Union: General Data Protection Regulation (GDPR)

Under the GDPR, health data is a special category of personal data under Article 9. Processing generally requires both a lawful basis under Article 6 and a valid condition under Article 9, subject to the Regulation's exceptions and safeguards.

Important provisions include:

Article 5: Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security.

Article 6: Lawful bases for processing personal data.

Article 9: Conditions governing the processing of health data and other special-category data.

Article 32: Appropriate technical and organisational security measures.

Article 33: Notification of certain personal-data breaches to the supervisory authority.

Article 88: Rules and safeguards for processing in the employment context.

An employer cannot assume that employee consent is always freely given merely because the employee signs a form. The imbalance of power in employment relationships can undermine whether consent is genuinely voluntary.

The European Data Protection Supervisor also stresses restricted access, confidentiality safeguards, risk assessment, and appropriate retention periods for workplace health information.

European Data Protection Supervisor+1

B. United States: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA requires particular care when discussing employee health information because its scope is frequently misunderstood.

The HIPAA Privacy Rule generally regulates covered healthcare providers, health plans, and other covered entities, together with applicable business associates. It does not generally protect an employer's employment records merely because those records contain medical information.

For example:

A hospital generally cannot disclose a patient's medical records directly to an employer without authorisation unless a legal exception applies.

An employer's ordinary personnel file containing a doctor's note is generally not protected by HIPAA solely because it contains health information.

Health information held by an employer-sponsored group health plan may receive HIPAA protection in the plan's capacity as a covered entity.

Other federal and state laws may separately restrict employer inquiries, medical disclosures, disability discrimination, and the handling of employee medical records.

HHS.gov+1

C. United Kingdom: UK GDPR and Data Protection Act 2018

UK data-protection law treats health information as special-category data. Employers must identify an appropriate lawful basis and satisfy an applicable special-category condition, where required.

The Information Commissioner's Office provides specific guidance on workers' health information, including sickness records, occupational-health reports, medical examinations, and workplace health monitoring.

Official guidance: ICO guidance on information about workers' health.

Information Commissioner's Office

6. When may an employer lawfully access or disclose employee health data?

Confidentiality does not mean that employers can never process health information. It means that access and disclosure must be properly justified and controlled.

The precise legal outcome depends on the jurisdiction, the information involved, the recipient, the purpose, and the circumstances.

7. Employer obligations and best practices

A legally sound employee-health-data programme should include the following safeguards.

1. Establish a lawful basis

Document why the data is needed and identify the relevant statutory, regulatory, contractual, or other lawful basis for processing.

2. Restrict access

Give access only to authorised personnel who need the information for a defined purpose. HR staff should not automatically have access to complete clinical records.

3. Separate medical records

Store clinical records separately from ordinary personnel files, with appropriate permissions and audit logs.

4. Train employees and managers

Explain confidentiality obligations, permitted disclosures, secure communication procedures, and the consequences of unauthorised access.

5. Apply retention limits

Establish retention periods and securely delete or anonymise records when they are no longer required, subject to legal retention obligations.

6. Respond to breaches

Investigate accidental emails, unauthorised downloads, lost devices, and improper disclosures. Contain the breach and follow applicable notification and remediation requirements.

8. Illustrative legal scenarios

Scenario A: Disclosure of an employee's HIV status

A human-resources manager shares an employee's HIV status in a staff messaging group without a legitimate purpose.

Legal analysis: This could constitute an unauthorised disclosure of sensitive medical information and may expose the employer or responsible individuals to applicable data-protection, confidentiality, employment, or discrimination claims. The mere fact that the information is true does not make its disclosure lawful.

The exceptional circumstances considered in Mr. X v. Hospital Z should not be treated as permission for indiscriminate workplace disclosure.

Scenario B: Mental-health information and promotion

A manager obtains an employee's psychiatric report and uses the diagnosis alone to deny a promotion, without assessing the actual job requirements or any applicable accommodation obligations.

Legal analysis: Depending on the jurisdiction and facts, this may raise questions of unlawful medical-data processing, disability discrimination, failure to accommodate, and misuse of confidential information. A diagnosis alone does not automatically establish that an employee is incapable of performing a role.

Scenario C: Occupational-health report

An occupational-health doctor reports that an employee can perform their duties with a restriction on night shifts. The employer receives the restriction but not the employee's entire psychiatric or medical history.

Legal analysis: This is generally a better confidentiality model because it provides job-relevant information while limiting access to unnecessary clinical details, provided the processing and disclosure have an appropriate legal basis.

Scenario D: Unauthorised disclosure by an HR employee

An HR officer downloads medical certificates and sends them to an outside party without permission or a lawful basis.

Legal analysis: The employer should investigate the incident, preserve relevant evidence, restrict further access, assess notification duties, and consider appropriate disciplinary and legal action. Liability depends on the applicable law and the facts.

9. Remedies for breach of confidentiality

An affected employee may have several potential remedies, depending on the applicable legal framework.

Regulatory complaint: A complaint to the relevant data-protection or other competent authority.

Civil proceedings: A claim for damages or other relief where a recognised cause of action exists.

Employment grievance: An internal complaint or employment-law claim concerning improper handling of medical information.

Injunctive relief: Where available, an order to prevent further disclosure or misuse.

Corrective measures: Restriction of access, correction of records, deletion where legally appropriate, or improved security.

Discrimination remedies: Where unauthorised disclosure is associated with unlawful discriminatory treatment.

In India, the available route will depend on the applicable legislation, the status of the employer, the nature of the breach, and the provisions in force at the relevant time. Not every confidentiality breach automatically gives rise to compensation, and a statutory complaint does not necessarily establish a private damages claim.

10. Conclusion

Confidentiality of employee health data is an essential part of workplace privacy, responsible employment administration, medical ethics, and data governance. The strongest legal approach combines lawful collection, limited access, purpose limitation, secure storage, appropriate retention, and carefully controlled disclosure.

The Indian Supreme Court's decision in Justice K.S. Puttaswamy (Retd.) v. Union of India establishes the constitutional importance of privacy, while Mr. X v. Hospital Z illustrates that confidentiality may be subject to narrowly justified exceptions. Sharda v. Dharmpal further demonstrates that medical privacy must be balanced against properly established legal needs.

Ultimately, an employer's need to know is not the same as an unrestricted right to know. Employee health information should be disclosed only where a valid legal basis or applicable exception supports the disclosure, and only to the extent reasonably justified.

Legal note: This is a general research overview, not jurisdiction-specific legal advice. The precise statutory position should be verified against the law in force on the relevant date.