Disclosing Medical Information To Employers: Australian Legal Guide

When you run a small business, you wear a lot of hats. On any given day you might be managing rostering, cashflow, client expectations, and (sometimes) unexpected staff issues like injuries, illness, or requests for workplace adjustments.

That’s where the issue of disclosing medical information to employers comes in. You may need some medical information to make safe decisions, process leave, understand fitness for work, or meet your WHS obligations. At the same time, an employee’s medical information is highly personal, and mishandling it can quickly create legal risk and trust issues in your workplace.

This guide walks you through what you can ask for, what you should avoid asking for, how to request information in a respectful way, and how to manage medical information once it’s provided. We’ll keep it practical and focused on what small businesses need to do day-to-day.

Why Disclosing Medical Information To Employers Is A Legal Risk Area

Medical information often sits at the intersection of several legal obligations. As a business owner, it’s not enough to think “I just need to know if they can work”. You also need to consider how that information was collected, whether you’re entitled to request it, and what you do with it once you have it.

In practice, issues commonly come up when:

• an employee takes personal/carer’s leave and you need evidence
• an employee says they can’t perform certain duties due to a medical condition
• there’s a workplace injury and you need to manage a safe return to work
• there’s a performance or misconduct issue, and an employee says it relates to health
• you’re considering standing down or ending employment on medical grounds

When medical information is involved, it can trigger obligations relating to:

• privacy and confidentiality (how you collect, store, use and share information)
• discrimination risk (whether decisions disadvantage a person because of disability or illness)
• work health and safety (ensuring your workplace is safe and that an employee is fit for work)
• Fair Work compliance (leave, directions, and procedural fairness)

The good news is that you don’t need to know “everything” to manage risk. The safest approach is usually to request only the information you genuinely need for a specific decision, and to handle it carefully.

What Can You Ask For (And What Should You Avoid)?

One of the most common small business questions is: “Can I ask an employee for their diagnosis?”

Often, the better question is: “What do I need to know in order to run the business safely and fairly?”

What You Can Commonly Ask For

In many situations, it’s reasonable to ask for medical information that is relevant to work. That tends to include:

• Fitness for work (for example: can the employee safely perform their usual duties?)
• Work restrictions (for example: no lifting over 10kg, reduced standing, or no night shifts)
• Estimated timeframes (for example: likely duration of incapacity or a review date)
• Capacity recommendations (for example: phased return to work, reduced hours, or temporary alternative duties)
• Evidence for leave (for example: confirming the employee was unfit for work on a particular day)

This kind of information helps you manage rostering, plan coverage, and comply with WHS duties without forcing an employee to disclose details you don’t actually need.

What You Should Usually Avoid Asking For

Asking for unnecessary details can increase risk. Depending on the circumstances, it may be inappropriate to request:

• the employee’s full diagnosis (unless it is genuinely necessary for a specific work decision)
• medical history unrelated to their role
• full medical records
• information about medication unless it impacts safety or capacity to work (and even then, keep it tightly work-related)

If your request is broader than necessary, you may create a privacy issue and also increase the chance of a discrimination complaint if the information influences decisions later.

A Helpful Rule Of Thumb: “Need To Know” Only

If you’re unsure whether a request is appropriate, a practical “need to know” test helps:

• What decision am I trying to make? (leave approval, return to work, adjustments, safety management)
• What information is necessary to make that decision?
• Can I make the decision with less detail? (often, yes)

When Can Employers Request Medical Evidence Or Clearance?

There are several common points in the employment lifecycle where medical evidence becomes relevant. The key is to keep requests reasonable, consistent, and tied to a clear business purpose. It’s also important to check any applicable modern award, enterprise agreement, employment contract and workplace policies, as these can set specific rules about evidence and process.

Personal/Carer’s Leave Evidence

Where an employee takes paid personal/carer’s leave, you can generally ask for evidence that would satisfy a reasonable person (including where the leave is taken because the employee is unfit for work). That evidence is often a medical certificate or statutory declaration, but what’s reasonable can depend on the circumstances and any applicable award or enterprise agreement.

If you’re trying to set expectations consistently, your employment contract and policies matter. A clear Employment Contract can help you spell out what evidence is required and when (as long as it doesn’t undercut minimum legal entitlements).

As a practical tip, you should apply your approach consistently across staff where possible, and be mindful of award or enterprise agreement requirements (if applicable).

Return To Work After Illness Or Injury

It’s common to request medical clearance (or other medical evidence about capacity) where an employee is returning after an illness or injury, particularly if:

• the role is safety-sensitive (driving, machinery, physical work)
• there’s a risk of aggravation or re-injury
• the employee’s capacity is unclear
• you need to identify suitable duties

However, “medical clearance” shouldn’t be used as a blanket demand for broad personal information. Ideally, it should focus on fitness for work and any restrictions. If the issue relates to a workplace injury, there may also be specific state or territory workers’ compensation and return-to-work obligations to follow.

If you want a deeper view of the practical considerations and risk points here, medical clearance is a helpful concept to get clear on early.

If There Are Safety Or Performance Concerns

Sometimes a situation escalates because an employee appears unfit for work, or their behaviour suggests a safety risk. In those cases, you may need to pause work and get further information.

This is especially sensitive if you’re considering temporarily removing an employee from duties while you investigate concerns. If that scenario is on the table, you’ll want to handle it carefully and consistently with your contracts and policies, as covered in standing down an employee situations.

How To Handle Employee Disclosures (And How To Ask The Right Questions)

Even if you don’t “ask” for medical information, employees may voluntarily disclose it. For example, they might tell a manager they have anxiety, ADHD, a chronic illness, pregnancy-related complications, or they’re recovering from surgery.

When this happens, how you respond matters. It can affect:

• the employee’s trust in the business
• your legal exposure (privacy and discrimination)
• your ability to manage attendance and safety fairly

Use A Structured, Respectful Process

A good approach is to keep the discussion calm, factual, and focused on work impact. You might say:

• “Thanks for letting me know. Are there any restrictions we should be aware of at work?”
• “Is there anything we can adjust in your duties or roster to support you?”
• “Would you be able to provide a medical certificate outlining capacity or restrictions?”

This encourages the employee to disclose what’s relevant without pressuring them to share personal details.

Be Careful With Managers And Informal Conversations

In small businesses, managers often have close working relationships with staff. That’s a strength, but it can lead to risky “informal” handling of private information.

Medical details should not become workplace gossip, even accidentally. Train supervisors to treat health disclosures as confidential and to escalate them through your usual HR/owner process.

Document Your Requests And Decisions

If you request medical information or make decisions based on it, keep written records:

• what was requested (and why)
• what was provided (and by whom)
• what decision was made (adjustments, leave, duties changes)
• the timeframe for review

This helps show your decision-making was reasonable and based on work requirements rather than assumptions about a condition.

Privacy, Confidentiality And Storage: What To Do Once You Have Medical Information

Once medical information is in your hands, your obligations don’t end. In many ways, that’s where the risk begins.

As a practical business owner, you should treat medical information as “high sensitivity” data. Privacy obligations can still apply in different ways depending on your business and how you handle employee records (including under the Privacy Act, state and territory laws, health records laws in some jurisdictions, and general confidentiality obligations).

Limit Access Internally

Access should be restricted to people who genuinely need the information to do their job (for example, the business owner, HR, or a direct manager implementing work restrictions).

A good internal rule is: managers can know restrictions; they don’t need the diagnosis.

Store Medical Information Securely

Medical information should be stored securely, separate from general personnel notes where possible. Depending on your setup, this could mean:

• restricted digital folders with permissions
• password-protected HR systems
• locked filing cabinets for hard copies

Also consider retention: don’t keep medical information “just in case” forever. Keep what you need for legal and operational reasons, and review periodically.

Don’t Disclose It Without A Clear Reason

Be careful about sharing medical information with:

• other employees
• clients or customers
• external contractors
• new managers during handovers

Even well-meaning comments (like “they’re off because of depression”) can create risk and harm relationships.

If you run a business that collects personal information more broadly (for example via online bookings, mailing lists, HR systems, or CCTV), it’s usually wise to ensure your Privacy Policy and internal practices align with how you handle sensitive information.

Common Scenarios For Small Businesses (And How To Respond)

Here are a few situations where disclosing medical information to employers becomes a real operational issue, along with practical ways to handle them.

1. The Employee Keeps Calling In Sick Without Details

If sick leave is frequent, unpredictable, or impacting operations, it’s reasonable to request appropriate evidence (where you’re entitled to do so) and to have a conversation about capacity and attendance expectations.

Keep the focus on work impact, not suspicion. For example:

• ask for medical certificates for absences (as allowed)
• ask whether there are restrictions or adjustments that could help
• document patterns and discussions

You may also need to check award requirements and consistency of approach across the team.

2. The Employee Says They Have A Medical Condition And Need Adjustments

If an employee requests adjustments, your goal is usually to:

• understand what changes are being requested
• assess whether the changes are workable in your business
• confirm medical support for restrictions (where appropriate)

Adjustments might include modified duties, altered start times, reduced hours, or additional breaks. Some are easy; some can create flow-on issues for clients or other staff.

Where adjustments involve changing rosters, ensure you also understand your obligations around notice of shift changes and cancellations. Having a clear internal policy for your workplace (and ensuring managers follow it consistently) helps prevent confusion later, including in areas like shift changes.

3. You Suspect The Employee Is Unfit For Work Today

Fitness for work issues can involve fatigue, mental health episodes, side effects of medication, or physical incapacity.

What you do next should be safety-first and respectful. Consider:

• removing the employee from safety-sensitive duties temporarily
• arranging safe transport home if needed
• requesting medical clearance (or other evidence of capacity) before returning to particular duties, if reasonably necessary
• documenting your observations (factually, without assumptions)

If you need a deeper process (especially for repeated incidents), it’s worth getting advice early, because “fitness for work” can overlap with disciplinary risk and discrimination risk.

4. You Are Considering Ending Employment Due To Ongoing Medical Incapacity

This is one of the highest-risk areas for small businesses.

While a business can sometimes lawfully end employment where an employee is unable to perform the inherent requirements of the role (even with reasonable adjustments), the process and evidence matter.

Decisions should not be rushed, and you should avoid assumptions. You may need up-to-date medical evidence, a clear understanding of the role’s inherent requirements, and a well-documented process.

If you’re at this stage, it’s important to understand the obligations and risk areas around termination on medical grounds before you take action.

5. Your Business Has Medical Information Spread Across Emails And Messages

In many small businesses, medical certificates arrive via email, photos via SMS, or messages in a rostering app. Over time, confidential information ends up everywhere.

A practical fix is to set up one channel for medical documentation (for example, a dedicated HR email), and a simple internal rule that managers must forward documents and delete local copies where possible. This reduces the risk of accidental disclosure.

Key Takeaways

• When medical information is disclosed to employers, it’s a sensitive area where privacy, discrimination risk, WHS duties, and Fair Work obligations can overlap.
• In most cases, you should only request medical information on a “need to know” basis, focusing on fitness for work, restrictions, and timeframes rather than a detailed diagnosis.
• When requesting evidence or medical clearance, keep your request reasonable, consistent, and work-related, and check any applicable award, enterprise agreement, contract or policy requirements.
• Treat medical information as highly confidential: limit internal access, store it securely, and avoid sharing details beyond what’s necessary to manage work safely.
• High-risk scenarios (like ongoing incapacity, standing down, or potential termination) should be handled carefully and usually benefit from early legal advice.

If you’d like help setting up the right documents and processes for managing medical disclosures at work, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.