Under the Health Insurance Portability and Accountability Act (HIPAA), federal law requires employers to protect medical records as confidential information that is kept separate and apart from other business records. Medical information may not be retained in a personnel file. The Americans with Disabilities Act (ADA) also imposes very strict rules for handling information obtained through post-offer medical examinations and inquiries. Compliance with the ADA requires that information related to medical disabilities be handled in a confidential manner. Provisions in California law, such as the Confidentiality of Medical Information Act, the Information Practices Act, the California Constitutional Right to Privacy, and the California Evidence Code provisions recognizing physician and psychotherapy records as privileged, also require confidential treatment of medical information and records.
As an employer covered under the federal law and California state law described above, UC Berkeley must keep the medical records of its employees (i.e., any information related to an employee's medical condition or the medical condition of their family members) confidential and separate from other personnel records. This information may be revealed only in very limited circumstances, such as to safety and first aid workers if necessary to treat an employee; to public safety officials to protect the employee or others from a serious and imminent threat to health or safety; to mandated reporters to law enforcement to report child, elder or dependent abuse; to the employee's supervisor, if appropriate under applicable law and the employee's disability requires restricted duties or a reasonable accommodation; and to University officials as required by law for the purposes of defending the University in judicial or administrative proceedings; or for purposes of compliance with worker's compensation programs.
There are various civil and criminal penalties which may apply for disclosure of information or for failures to make required reports, such as reports of child abuse. The potentially serious penalties attached to such conflicting obligations of confidentiality and reporting mean that care must be taken in handling of medical records or information. Any questions about confidentiality or disclosure of medical records or medical information should be referred to campus counsel. This should be done at the earliest possible moment if there is a situation involving imminent and serious threat to a person's health or safety.
While physically separate from the official personnel file, the medical file may be stored in the same locked cabinet as an employee's official personnel file. The medical file may even be placed next to the official personnel file as long as there is a clear division between them and they can be accessed independently of each other.