In a February 18, 2010, informal letter, an Equal Employment Opportunity Commission senior staff attorney responded to an inquiry concerning the duties of federal employees and contractors relating to medical confidentiality under the Rehabilitation Act. The letter discusses the role of medical records custodians (MRCs) – those individuals whose official duties require access to employee medical information. Because the same legal standards apply to private-sector employers under the Americans with Disabilities Act’s medical confidentiality rules, the principles discussed in this letter can be helpful for all employers, including federal contractors.

The letter explains that MRCs should work in an environment that does not allow for unauthorized co-workers to have access to employee medical information. It goes on to list certain steps federal agencies and covered contractors should take to safeguard the confidentiality of employee medical information:

1. Remind all employees that medical information is confidential and only MRCs are authorized to have access to such information on a need-to-know basis.
2. Issue a memorandum informing all employees that anyone who discusses another employee’s medical information with unauthorized persons or reads medical documents not intended for him or her will be disciplined.
3. To ensure that other employees, including other MRCs, cannot overhear conversations about an employee’s confidential medical information, consider providing an office with a door that an MRC can use when he or she needs to discuss an employee’s medical condition or history by telephone or in person.
4. Install a fax machine that is shared only by other MRCs in the office, with the door kept locked except when in use by an MRC.
5. Remind MRCs to keep any employee medical information in a locked file cabinet in their cubicles or in a file cabinet in the shared office to which only other MRCs have access.
6. Periodically audit policies and procedures to ensure sufficient measures are in place to guarantee the confidentiality of employee medical information and protect against unauthorized disclosure.

While the EEOC Office of Legal Counsel’s letter is not an official opinion of the Commission, it provides insights into the EEOC’s view of potential safeguards to protect against unlawful disclosure of employee medical information under the ADA and Rehabilitation Act. Organizations with multiple departments reviewing employee medical information in connection with an injury or illness (such as departments for occupational health, risk management, HR and benefits) may have the greatest need to adopt recommended safeguards to protect employee medical information from unlawful disclosure.