No. When your practice keeps a doctor's note, a leave certification or a return-to-work release about one of your own employees, the Health Insurance Portability and Accountability Act (HIPAA) does not apply to it. Those are employment records. They still have to be kept confidential, though, under two other federal laws, and that second half is where practices get into trouble.
Here is how the rules actually split, who they reach, and the one exception that matters most for a medical practice.
Why HIPAA doesn't apply to your staff files
HIPAA protects protected health information (PHI). The federal definition of PHI carves out one category on purpose: information "in employment records held by a covered entity in its role as employer."
A medical practice wears two hats. As a provider, it holds patient charts, and HIPAA governs every one of them. As an employer, it holds personnel files, sick notes and leave paperwork about its own staff. That second set of records is outside HIPAA, even though the same building, the same people and sometimes the same filing cabinet hold both.
The mistake runs in two directions. Some practices treat employee paperwork as patient records and lock everything down so tightly that the people who administer leave can't do their jobs. More often, practices decide that since HIPAA doesn't apply, nothing does, and a doctor's note ends up stapled to a performance review.
Which rules apply instead
Two federal laws fill the gap, and each has a size threshold.
The Family and Medical Leave Act (FMLA) applies to private employers with 50 or more employees for each working day in 20 or more workweeks in the current or prior year. Its recordkeeping rule says records relating to certifications, recertifications or medical histories of employees or their family members "shall be maintained as confidential medical records in separate files/records from the usual personnel files."
The Americans with Disabilities Act (ADA) applies to employers with 15 or more employees for 20 or more weeks. When an employer obtains medical information through an exam or a medical inquiry, the ADA requires that it be kept "on separate forms and in separate medical files and be treated as a confidential medical record."
Your state may add its own rules on top of these, and some reach smaller employers. Check yours before assuming the federal floor is the whole picture.
What belongs in the separate medical file
Think of every employee as having two folders.
The medical file holds:
- Doctor's notes for absences
- FMLA certifications and recertifications
- Work restrictions and return-to-work releases
- Accommodation requests and the medical paperwork behind them
- Results of any medical exam the job requires
The personnel file holds everything else that describes the job: the offer letter, the job description, performance reviews, pay changes, training records and any corrective action.
When a document lands on a manager's desk, the question to ask is simple. Does it say anything about this person's health? If yes, it goes in the medical file.
Who should be able to open the medical file
A short list. Usually the person who administers leave and benefits, plus the owner or practice administrator if they make those decisions.
The ADA spells out who else may be told, and how much. Supervisors and managers may be informed about necessary restrictions on the employee's work and necessary accommodations. First aid and safety staff may be told when a condition might need emergency treatment. Government investigators get relevant information on request.
Notice what the supervisor gets: the restriction, not the diagnosis. "She can't lift more than ten pounds until the 23rd" is what a manager needs to schedule the week. Why she can't lift is not.
The catch when your employee is also your patient
This one is specific to medical practices, and it comes up more than you'd expect. If someone on your staff is also your patient, their chart is protected health information, and HIPAA governs it like any other patient's.
Same person, two records, two sets of rules. What decides which rules apply is the role your practice was in when the record was created: provider or employer.
The practical habit is to keep the two completely apart. If you need medical information for a leave request, get it through the normal certification process, the same way you would for any employee. Never open a chart to check on an employee's absence, and never let what's in a chart drive an employment decision.
What to do this week
Pick five employee files at random. Open each one and look for anything medical mixed in with the reviews and pay records: a doctor's note, a leave form, a restriction letter.
Move each one you find into a separate folder for that employee, locked or permission-restricted, and label it "Medical, confidential."
Then write down every person who can open those folders. If the list runs past two or three names, shorten it.
Frequently asked questions
Is a doctor's note for a sick day protected health information?
Not when it sits in your employee's file. You received it as their employer, so it is an employment record outside HIPAA. File it with that employee's confidential medical records, not in the personnel file.
Can a manager know why an employee is out on leave?
A manager needs the dates and any work restrictions to plan coverage. Under the ADA, supervisors may be told about necessary restrictions and accommodations. The diagnosis itself should stay with whoever administers leave.
We have 12 employees. Does any of this apply to us?
The federal FMLA and ADA thresholds won't reach you yet, but your state's rules might. Either way, keeping medical paperwork separate and confidential costs you a folder and a lock, and it's the habit you'll need the day you grow past 15 people.
Does this change if we're not a medical practice?
The employee-records half applies to any employer that meets the thresholds. The patient-chart exception only matters if your business also provides health care.
This is general information, not legal advice. If sorting through forty files sounds like a weekend you don't have, that's the kind of work we take off a practice's plate. You can book a time with us at stillridgebpo.com.