• Employers must protect the confidentiality of medical information.

Generally, employers may receive medical information only in aggregate form. This information does not disclose, and is not reasonably likely to disclose, the identity of specific employees.

Wellness programs that are part of a group health plan may generally comply with their obligation to keep medical information confidential by complying with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.

Employers that are not HIPAA-covered entities may generally comply with the Americans with Disabilities Act (ADA) by signing a certification that they will not use or disclose individually identifiable medical information for employment purposes and abiding by that certification.

It is also a good idea for employers to train individuals in the handling of confidential medical information, encryption of information in electronic form, and prompt reporting of breaches in confidentiality. This can help assure employees that their medical information is being handled properly.