29 CFR Part 1630, Regulations to Implement the Equal Employment Provisions of the ADA (Title I Regulations with amendments issued through May 2016)

(4)

(i) Confidentiality. Information obtained under paragraph (d) of this section regarding the medical condition or history of any employee shall be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record, except that:

(A) Supervisors and managers may be informed regarding necessary restrictions on the work or duties of the employee and necessary accommodations;

(B) First aid and safety personnel may be informed, when appropriate, if the disability might require emergency treatment; and

(C) Government officials investigating compliance with this part shall be provided relevant information on request.

(ii) Information obtained under paragraph (d) of this section regarding the medical condition or history of any employee shall not be used for any purpose inconsistent with this part.

(iii) Except as permitted under paragraph (d)(4)(i) of this section and as is necessary to administer the health plan, information obtained under this paragraph (d) regarding the medical information or history of any individual may only be provided to an ADA covered entity in aggregate terms that do not disclose, or are not reasonably likely to disclose, the identity of any employee.

(iv) A covered entity shall not require an employee to agree to the sale, exchange, sharing, transfer, or other disclosure of medical information (except to the extent permitted by this part to carry out specific activities related to the wellness program), or to waive any confidentiality protections in this part as a condition for participating in a wellness program or for earning any incentive the covered entity offers in connection with such a program.