Supervisor Oversharing

By Angela Adams, CEBS, SPHR, Director, EEO & Compliance Solutions
Published August 27, 2024

Q: Over the weekend, an employee ended up in the hospital and let her supervisor know. Before he contacted HR, he emailed her entire department and a few clients that she was in the hospital and what her diagnosis/prognosis was. Can our organization be liable somehow for him sharing too much? 

Organizations should limit medical information about employees only to those who “need to know.” Talk to the supervisor about not oversharing again, without the express permission of the employee. Instruct him to always check with HR before sharing anything. 

But now that it’s already done, do you have any liability? While the act of sharing information about her condition isn’t illegal on its face, it could lead to areas where you do have some liability, not to mention employee relations problems. 

First, under the Health Insurance Portability and Accountability Act (HIPAA), employers can’t share medical information they are privy to through the administration of a health insurance program. This situation doesn’t quite fit that, so there probably wouldn’t be liability under HIPAA privacy provisions. “Administration” includes seeing specific information about claims or having knowledge of what kind of coverage employees have and who they cover. It sounds like the employee shared her condition freely with the supervisor; the supervisor didn’t obtain it through administering a health plan. 

Second, if her illness rises to the level of a disability covered by the Americans with Disabilities Act (ADA), there are parameters surrounding who can receive information about an employee’s condition. Remember that an "individual with a disability" is a person who has a physical or mental impairment that substantially limits one or more major life activities, has a record of such an impairment, or is regarded as having such an impairment. Generally, employers can only share information about a disability with a very limited subset of individuals; this doesn’t normally include coworkers or clients.  

Many individuals being privy to her condition could be interpreted as a record of a disability or be regarded as having a disability. If she suffers any adverse employment actions, she could claim she is being discriminated against by the employer under the ADA. 

It's probably unlikely that she would sue under the ADA, but stranger things have happened, so supervisors should be aware that they can’t disseminate information without talking to HR. 

Third, you may have a general conduct policy that discusses keeping confidential information confidential. The supervisor sharing this data could signal to employees that organizational leadership isn’t cognizant of your own policies and lead to worry that their information might also be widely shared.  

How should you proceed then? Let the employee know what the supervisor revealed. Ask her how she wants you to proceed and if she wants you to share anything. If she does, what specifically? Explain that going forward, you will ask her permission before disclosing anything else.  

HR Source members with questions can contact us through the HR Hotline Online or at 800-448-4584. 

Have you ever had a supervisor share too much information about the health condition of an employee? Let your peers know how you handled it in our All Members Community on HR Exchange.