Three kinds of source appear below and they carry different weight, which is the whole point of the article. The regulation is 29 CFR 1630.14, a federal rule under Title I of the ADA. The appendix to Part 1630 is interpretive guidance published alongside it. EEOC's enforcement guidance (Notice 915.002, dated 7/27/00, and by its own terms in effect until rescinded or superseded) states on its face that its contents “do not have the force and effect of law and are not meant to bind the public in any way,” and carries a banner noting it was issued before the ADA Amendments Act of 2008. None of this is legal advice for your organization. For your own files and contracts, use employment counsel; for accommodation practicalities, the Job Accommodation Network's employer consulting is free and confidential at 800-526-7234.
Start with what we have already published, because it is correct and this article builds on it rather than replacing it: our guidance on disclosing at work tells employees their information must be kept separate from the personnel file and shared only with people who have a legitimate need to know, and our guide for employers on episodic conditions says the same from the other side of the desk. Good. The question this piece answers is the one that comes next in a real office: separate from what, in which file, and who exactly is on the list?
The Sentence, Three Times Over
Here is the rule, verbatim from 29 CFR 1630.14: information about an employee's or applicant's medical condition or history “shall be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record.”
Read the middle of that sentence slowly, because two obligations hide in it. Separate forms means the collection instrument itself is not your standard onboarding packet: the medical questions do not share a page with the tax paperwork. Separate medical files means the storage is a different file, not a labelled section at the back of the same folder. Most compliance failures we hear described are not disclosures at all — they are a form that asked two kinds of question at once, or a personnel file with a medical page in it.
And the structural fact that makes this worth an article: that sentence appears three separate times in the same section, in near-identical language, once for each context in which the regulation permits medical inquiries — the post-offer entrance examination, examinations of current employees, and voluntary wellness programs. Each of the three carries its own complete copy of the rule and its own complete copy of the exceptions. There is no master paragraph that governs the other two. If you are writing a policy, cite the paragraph that matches the situation you are in, or your citation points at a rule for a different kind of examination.
Tier One: The Recipient List in the Regulation
The regulation's own exception list is short, closed, and repeated with each of those three copies. In its words, the file may be opened to:
- “Supervisors and managers,” who “may be informed regarding necessary restrictions on the work or duties of the employee and necessary accommodations” — note the scope: the restrictions and the accommodations, not the diagnosis behind them.
- “First aid and safety personnel,” who “may be informed, when appropriate, if the disability might require emergency treatment.”
- “Government officials investigating compliance with this part,” who “shall be provided relevant information on request.”
That is the entire regulation-text list. Everyone else your HR intranet mentions comes from somewhere else, which is the next two sections.
One more limit that lives beside the disclosure rule and is routinely merged into it: results of a permitted examination “shall not be used for any purpose inconsistent with this part.” That is a use restriction, not a disclosure restriction. A file can be stored perfectly and still be used improperly, and the two rules fail independently.
Tier Two: The Appendix
The interpretive appendix to Part 1630 adds recipients the regulation text does not name, and it is worth knowing the mechanism, because it is not an ADA exception at all. On workers' compensation, the appendix says state laws “are not preempted” and that employers “may submit information to State workers' compensation offices or second injury funds in accordance with State workers' compensation laws without violating this part.” So those two recipients exist because a different body of law requires the reporting and the ADA does not stand in its way — not because the ADA authorized them.
The same appendix is also where HIPAA enters, and its posture will surprise employers who assume HIPAA governs their medical file. Where a wellness program is part of a group health plan, the appendix notes that individually identifiable health information collected there is protected health information under the HIPAA rules, and that “HIPAA covered entities may not disclose PHI to an individual's employer except in limited circumstances.” Read that direction carefully: in this context HIPAA operates as a restriction on what the employer may receive, not as a rule about how the employer files what it already holds.
The commonest employer mix-up is assuming HIPAA governs the employment medical file. It does not: the file you keep under this regulation is governed by this regulation. But do not overcorrect into saying HIPAA appears nowhere in the ADA rules, because a reader who checks will find it. Counted from the official text the day this published, HIPAA appears twelve times in Part 1630 — once in the regulation itself, in the wellness-program notice provision, which requires telling participants how their information will be protected “including whether it complies with the measures set forth in the HIPAA regulations,” and eleven more times in the appendix, all under its confidentiality heading. The true claim is the narrow one: HIPAA does not supply the filing rule for your post-offer or employee medical records, and the places it does appear are about wellness programs and group health plans.
Tier Three: EEOC Guidance, Which Goes Furthest
The two recipients employers most often ask about — the workers' compensation insurance carrier, and a health care professional consulted while working out an accommodation — appear in neither the regulation nor the appendix passage above. They come from EEOC's enforcement guidance, whose footnote states that the Commission “has interpreted the ADA to allow employers to disclose medical information to state workers' compensation offices, state second injury funds, workers' compensation insurance carriers, and to health care professionals when seeking advice in making reasonable accommodation determinations.”
Notice what just happened: the guidance cites the appendix, and then names two recipients the appendix does not. That is not a scandal — it is an agency stating how it reads the law it enforces, which is exactly what enforcement guidance is for. It is also precisely why the tiers must stay labelled. The regulation says X. The appendix adds Y. EEOC reads it as Z. Anyone who tells you “the law says you can send it to the carrier” has flattened three sources into one sentence, and has attributed to a regulation something that lives in a document which says of itself that it does not have the force and effect of law.
What This Means for Your Filing System
- Two artifacts, not one: a separate form for collection, and a separate file for storage. Auditing only the second one misses the commonest failure.
- Cite the paragraph that matches the situation — entrance examination, employee examination, or wellness program — because each states its own rule and its own exceptions.
- Train supervisors on the scope, not just the secrecy: the regulation lets them be told about restrictions and accommodations. The underlying condition is not part of that permission, and a well-meaning manager explaining why someone has a modified schedule is the disclosure risk in most workplaces.
- Keep your recipient list tiered in your own policy, with a note beside the last group that it rests on agency guidance rather than regulation text. If your policy is ever examined, having shown your work is worth more than having a tidy bullet list.
- Retention is not answered here. This regulation sets no retention period, and we are not importing one from elsewhere; if you need a schedule, that is a separate question for counsel. Our charge-process guide covers preservation once a charge is in play.
One deliberate omission: everything about when an employer may require an examination in the first place, and what may be done with a result that screens someone out, belongs to the article we published on Monday. This one is only about the file. And for the operational side of supporting someone whose condition changes on the job, our stay-at-work playbook is the piece that already carries the confidentiality beat in a live scenario.
29 CFR Part 1630 and its appendix were re-pulled from the Government Publishing Office's official text the day this published, and the eCFR's version history confirms §1630.14 was last amended January 1, 2019 — the quoted text is current. The EEOC enforcement guidance was re-read at eeoc.gov the same day, footnote intact, along with its own disclaimers. The count of HIPAA mentions was taken from that official text rather than from memory. Regulations and guidance are the government's to change; if this article ever disagrees with the current official text, trust the official text and tell us.