Can an Employer Ask for an Employee’s Medical Records?

Key Takeaways

• An employer can ask for certain medical information, but there is no general right to demand an employee’s entire medical history. The information sought should have a legitimate connection with employment, occupational health, safety, medical leave or fitness for work.
• Medical records are closely connected with the right to privacy. The Supreme Court has recognised informational privacy as part of the fundamental right to privacy under Article 21 and has specifically observed that unauthorised disclosure of medical records may amount to an invasion of privacy.
• A medical fitness certificate and complete medical records are not the same. An employer may sometimes be justified in seeking confirmation that an employee is fit or unfit for work without being entitled to detailed diagnoses, treatment histories, prescriptions or unrelated medical information.
• Certain jobs may require medical examinations because of occupational health and safety laws. Section 6 of the Occupational Safety, Health and Working Conditions Code, 2020 requires prescribed annual health examinations or tests for specified classes of employees and establishments.
• Doctors and hospitals generally have confidentiality obligations. An employer cannot ordinarily obtain an employee’s medical records directly from a doctor or hospital merely because an employment relationship exists.
• HIV-related information receives specific statutory protection. The HIV and AIDS (Prevention and Control) Act, 2017 restricts discrimination, compulsory testing and disclosure of HIV-related information in employment and other contexts.
• Whether an employee can refuse a request depends on the circumstances. An unnecessarily broad demand may be objectionable, while refusal may have consequences where a medical certificate, fitness examination or health test is lawfully required for employment or workplace safety.

Is an Employer Allowed to Ask for an Employee’s Medical Records?

An employer in India can ask for medical information in certain circumstances, but cannot ordinarily demand unrestricted access to an employee’s complete medical records.

The legal position depends on why the information is required. A request connected with medical leave, fitness to resume work, occupational health, workplace safety or a statutory medical examination may be legitimate. However, an employer seeking complete hospital files or details of unrelated illnesses without a genuine employment-related purpose may raise serious privacy concerns.

Add LawBhoomi as your preferred source on Google.

Add Now →

Medical records contain highly personal information about an individual’s physical health, mental health, diagnoses, treatments, prescriptions, surgeries and medical history. Indian law therefore treats such information differently from ordinary workplace information.

The central principle is that the medical information sought should ordinarily be relevant, necessary and proportionate to the legitimate purpose for which it is required.

Are Medical Records Protected by the Right to Privacy?

Yes. Medical records are closely connected with the constitutional right to privacy in India.

In Justice K.S. Puttaswamy (Retd.) v Union of India, a nine-judge Bench of the Supreme Court recognised the right to privacy as an intrinsic part of the right to life and personal liberty protected by Article 21 of the Constitution.

Access subject-wise law notes for free on LawBhoomi.

Explore Notes →

The judgment gave particular importance to informational privacy. It explained that privacy includes an individual’s interest in controlling access to personal information.

The Supreme Court specifically observed that unauthorised sharing of medical records furnished by an individual to a hospital would amount to an invasion of privacy.

This principle is important in employment relationships. Merely because an employer has authority to manage the workplace does not mean that every aspect of an employee’s personal medical history becomes available to the employer.

At the same time, privacy is not absolute. Legitimate restrictions may arise under law, particularly where occupational health, workplace safety or the rights of other persons are involved.

When Can an Employer Ask for Medical Information?

An employer may have a legitimate reason to seek limited medical information where it directly affects employment.

Common situations include the following.

Medical Leave

An organisation may require a medical certificate when an employee takes sick leave, particularly where the absence continues beyond the period allowed without medical documentation under employment rules or company policy.

The purpose of such a requirement is normally to establish that the absence was genuinely connected with illness.

Explore practical law courses to build career-ready legal skills.

Explore Courses →

This does not automatically mean that the employer can demand the employee’s complete treatment records. A certificate confirming that the employee was medically unfit for work during a stated period may often be sufficient.

Fitness to Return to Work

An employer may require a fitness certificate where an employee returns after serious illness, surgery, prolonged medical leave or an injury.

This may be particularly relevant where the nature of employment involves physical activity, operation of machinery, transportation, hazardous materials or responsibility for the safety of others.

The employer’s concern in such a case is ordinarily whether the employee can safely perform the required duties.

Therefore, information about functional fitness may be relevant without requiring disclosure of the employee’s complete medical history.

Workplace Safety

Medical information may sometimes be required where an employee’s medical condition creates a genuine occupational safety concern.

For example, the nature of certain work may require employees to satisfy prescribed standards relating to physical fitness, vision, hearing or other health-related conditions.

Such requirements are stronger where safety-sensitive work is involved than where an employee performs an ordinary office-based role.

Statutory Medical Examination

Certain medical examinations may be required under occupational health and safety laws.

Explore LawBhoomi's free law library for students and lawyers.

Visit Library →

The Occupational Safety, Health and Working Conditions Code, 2020, which came into force on 21 November 2025, imposes important health and safety responsibilities on employers. It forms part of India’s wider new labour codes framework.

Section 6 requires employers to ensure that workplaces are free from hazards likely to cause injury or occupational disease and to provide prescribed annual health examinations or tests free of cost to specified employees.

Where a statutory health examination applies, an employer may therefore have a lawful basis for requiring the relevant examination.

However, even a statutory examination does not necessarily create an unrestricted right to inspect unrelated medical information.

Can an Employer Ask for Complete Medical History?

Ordinarily, an employer should not require an employee’s entire medical history unless there is a sufficiently strong and lawful reason for doing so.

There is a significant difference between asking:

“Is the employee medically fit to perform the duties of this position?”

and asking for:

• details of every previous illness and hospitalisation;
• complete prescription history;
• unrelated diagnostic reports;
• details of previous surgeries having no connection with the job;
• psychiatric or psychological treatment records unrelated to workplace requirements;
• reproductive health information; or
• medical information concerning family members.

The first request may sometimes be justified because it directly concerns employment. The second category is much broader and may intrude unnecessarily into private life.

The nature of the employment also matters. Medical scrutiny which may be reasonable for a pilot, heavy machinery operator or worker handling hazardous substances may not necessarily be reasonable for an employee performing ordinary administrative work.

Can an Employer Ask for a Medical Fitness Certificate?

Yes. Requiring a medical fitness certificate may be lawful where there is a genuine reason connected with employment.

A fitness certificate normally answers a limited question: whether the employee is medically capable of performing work or resuming duties.

For example, a doctor may certify that:

The employee is medically fit to resume duties from a specified date.

Such certification does not necessarily require disclosure of the detailed diagnosis or complete treatment history.

Where the employer’s legitimate concern can be addressed through a fitness certificate, demanding considerably more medical information may be difficult to justify.

Can an Employer Ask for Medical Records During Sick Leave?

An employer may require reasonable medical evidence supporting sick leave, depending on applicable service rules, employment policies, standing orders or terms of employment.

However, proof of illness and complete medical records serve different purposes.

A medical certificate may establish:

• that the employee was medically unfit for work;
• the period during which the employee required rest;
• whether additional leave is medically required; and
• whether the employee is fit to return to work.

Detailed clinical notes, test results and complete treatment files may not be necessary merely to establish entitlement to ordinary sick leave.

Can Employers Require Pre-Employment Medical Tests?

Pre-employment medical examinations are not automatically prohibited in India.

Certain employers may require candidates to satisfy medical fitness standards before appointment, particularly where the nature of work makes physical or occupational fitness important.

Such requirements may exist in sectors involving hazardous work, transportation, industrial activity, physically demanding employment or public safety.

However, the medical examination should ordinarily have a reasonable relationship with the requirements of the job.

A pre-employment medical test should not become an unrestricted enquiry into every aspect of an applicant’s medical life where the information has no bearing on the position.

Special laws may also prohibit particular forms of testing or discrimination.

Can Employers Ask About HIV Status?

HIV-related medical information receives specific statutory protection under the Human Immunodeficiency Virus and Acquired Immune Deficiency Syndrome (Prevention and Control) Act, 2017.

Section 3 prohibits discrimination against protected persons in several areas, including employment. It addresses denial or termination of employment and unfair treatment in relation to employment on grounds connected with HIV status.

The Act also places significant restrictions on HIV testing and disclosure of HIV-related information.

Therefore, HIV testing cannot ordinarily be treated as a routine condition for obtaining or continuing employment.

The legislation recognises limited exceptional situations, but these cannot be converted into a general right for employers to demand HIV status from employees.

Can a Doctor Give Medical Records to an Employer?

A doctor or hospital cannot ordinarily disclose a patient’s confidential medical information to an employer merely because the employer requests it.

The relationship between a doctor and patient carries an important obligation of confidentiality. Maintaining medical records and respecting patient confidentiality form part of the broader duties of a medical professional or doctor.

In Mr X v Hospital Z, the Supreme Court considered medical confidentiality in the context of disclosure of a person’s HIV-positive status. The Court recognised the general importance of confidentiality while holding that exceptionally, competing rights and serious risks to identifiable persons may justify disclosure. The Court later clarified the limited nature of its earlier observations.

The case is important because it demonstrates two principles.

First, medical confidentiality is legally significant.

Second, confidentiality is not absolute where exceptionally strong competing interests recognised by law are involved.

An ordinary employer request, however, does not by itself create such an exception.

Are Employee Medical Records Sensitive Personal Data?

Medical information has historically received enhanced protection under India’s information technology framework.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 recognise physical, physiological and mental health conditions and medical records and history as sensitive personal data or information.

The framework requires organisations handling such information to follow requirements relating to collection, consent, purpose, disclosure and reasonable security practices.

India is now transitioning to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

The Central Government notified the implementation framework on 13 November 2025. However, several substantive provisions concerning processing of personal data, consent, obligations of data fiduciaries and rights of data principals are scheduled to commence eighteen months from that notification, that is, on 13 May 2027.

Therefore, as of August 2026, the data protection system remains in a transitional stage.

Can an Employee Refuse to Provide Medical Records?

Whether an employee can refuse depends on the nature and legal basis of the request.

An employee may have stronger grounds to object where an employer asks for information that is:

• unrelated to employment;
• excessively detailed for the stated purpose;
• concerned with medical conditions having no effect on work;
• requested without explaining why the information is necessary; or
• broader than the information reasonably required to establish fitness or medical leave.

However, refusal is not necessarily justified where the employer is lawfully entitled to require a particular medical examination or certificate.

For example, where occupational safety rules require employees performing particular work to satisfy medical standards, refusal to undergo the required examination may affect eligibility to perform those duties.

Similarly, an employment policy may reasonably require medical certification for prolonged sick leave.

The question is therefore not simply whether an employee can refuse medical disclosure. The relevant issue is whether the particular request itself is lawful and reasonable.

Can an Employer Share an Employee’s Medical Information?

Medical information obtained by an employer should not ordinarily be treated like general workplace information.

Even where information has been legitimately obtained, disclosure should normally be limited to persons who genuinely require access for the relevant purpose.

Depending on the organisation, this may include:

• authorised human resources personnel;
• designated occupational health professionals;
• persons responsible for workplace safety; or
• management personnel who require limited information to provide workplace adjustments.

There is usually no legitimate reason for detailed medical information to be circulated among colleagues or departments unrelated to the purpose for which it was obtained.

The Supreme Court’s recognition of informational privacy under Article 21 of the Constitution of India reinforces the importance of protecting medical information against unnecessary disclosure.

What If Medical Information Is Required for Workplace Accommodation?

Sometimes an employee may disclose a medical condition while requesting changes in working conditions.

For example, medical information may be relevant for:

• modification of working hours;
• temporary restrictions on physical work;
• exemption from particular duties;
• ergonomic changes;
• transfer away from hazardous work; or
• other reasonable workplace arrangements.

In such cases, the employer may legitimately ask for enough information to understand the employee’s functional limitations.

However, the focus should normally remain on what workplace adjustment is medically necessary rather than obtaining every detail of the underlying medical condition.

What Should an Employer Consider Before Asking for Medical Records?

A responsible medical-information request should answer several questions:

Is There a Legitimate Employment Purpose?

The employer should be able to identify why the information is necessary. General curiosity or a desire to maintain comprehensive medical files would not ordinarily be sufficient.

Is the Information Relevant?

The requested information should have a reasonable connection with the employee’s duties, absence, workplace safety or another legitimate employment requirement.

Is Less Information Sufficient?

Where a medical certificate or fitness declaration would address the concern, requesting complete hospital records may be unnecessary.

Is Access Restricted?

Medical information should be available only to persons who require it for the specific employment-related purpose.

Is the Information Secure?

Employers handling medical information should maintain appropriate safeguards against unauthorised access, disclosure, loss or misuse.

What Can an Employee Do If Medical Records Are Misused?

The appropriate remedy depends on how the information was obtained and misused.

An employee may first raise the issue through the employer’s HR department, grievance mechanism or data/privacy contact where one exists.

Where a hospital or medical practitioner has disclosed confidential records without a lawful basis, professional confidentiality obligations and other applicable legal remedies may become relevant.

A serious or unlawful invasion of privacy may also raise constitutional, statutory, employment or civil law issues depending on the facts and the identity of the organisation involved.

Special statutory remedies may apply where the information concerns HIV status or another area governed by specific legislation.

The precise remedy will therefore depend on whether the complaint concerns unlawful collection, unauthorised disclosure, discrimination, breach of confidentiality or misuse of information after it was obtained.

Conclusion

An employer can ask for an employee’s medical records in India only within reasonable legal limits. Employment does not give an employer an unrestricted right to know an employee’s complete medical history.

Limited medical information may legitimately be required for sick leave, fitness to work, occupational safety, workplace accommodation or statutory health examinations. However, the information sought should ordinarily remain connected with the purpose for which it is required.

A medical fitness certificate may often be sufficient without disclosure of detailed diagnoses and treatment history. Hospitals and doctors also remain subject to medical confidentiality obligations and cannot generally provide private records merely because an employer requests them.

The Supreme Court’s recognition of medical information as part of informational privacy, occupational health requirements under the Occupational Safety, Health and Working Conditions Code, 2020 and specific protections under laws such as the HIV and AIDS (Prevention and Control) Act, 2017 together establish an important principle: legitimate workplace health requirements may justify limited medical disclosure, but they do not remove an employee’s right to medical privacy.