Your employer can ask. Your doctor still needs your yes before saying anything back.
Not without your consent, in almost every situation. In the US, the Americans with Disabilities Act limits what employers can even ask for to what's job-related and consistent with business necessity, and HIPAA keeps your provider from disclosing details beyond that without your authorization. In the UK, the Access to Medical Reports Act 1988 goes further still: your employer needs your consent just to approach your doctor for a report in the first place, and you have the right to see that report before it's sent, and to ask for corrections to anything factually inaccurate.
| United States | United Kingdom | |
|---|---|---|
| Legal basis | Americans with Disabilities Act (ADA); HIPAA Privacy Rule | Access to Medical Reports Act 1988; UK GDPR |
| Can the employer ask for medical info directly? | Only what's job-related and consistent with business necessity — a blanket request for broad medical history generally violates the ADA | Employer must first get your written consent before applying to your doctor for a report at all |
| Can you see the report first? | Not a specific statutory right in the same way, but employers must keep any medical information confidential and stored separately from your general personnel file | Yes — you can request to see the report before it's sent, and have up to 21 days to arrange this once the employer applies for it |
| Can you correct inaccuracies? | Generally handled through the standard medical records amendment process with the provider | Yes, explicitly — you can ask the doctor to amend anything factually inaccurate or misleading before the report goes to your employer |
| Consequences of refusing consent | Employer generally cannot retaliate for refusing to release medical information beyond what's legally required — though refusing information tied to a specific legal process (e.g. a workers' comp claim) can affect that claim | Employer must make decisions based on other available information (fit notes, what you've told them) rather than the withheld report — refusing consent is your right |
The UK framework is unusually explicit about a specific scenario worth knowing: if you ask to see the report first and then decide you don't want it released to your employer after all, you can withdraw consent for that release — the employer doesn't automatically get the report just because they applied for it.
This is one of the clearest overreaches in both systems — a request has to be tied to a specific, legitimate purpose (fitness for a particular role, a specific accommodation request), not a general fishing expedition into your health history.
A doctor or occupational health provider disclosing anything to an employer without your prior consent is a straightforward breach of both frameworks — this isn't a gray area.
Consent obtained under coercion is on shaky legal ground in both jurisdictions. If refusing consent for a report is met with a direct threat rather than the employer simply proceeding with the information they already have, that's worth documenting and raising separately.
If you're asked to consent to a medical report, in the UK:
"I consent to this report being requested, but I'd like to see it before it's sent to my employer, as I'm entitled to under the Access to Medical Reports Act 1988."
If you believe your employer is asking for more than they're entitled to, in either country:
"Can you clarify specifically why this information is needed for my role, and confirm it will be limited to that purpose and kept confidential from my general file?"
Use Kibbo's Employment tools to understand exactly what you're agreeing to before you sign anything.
Explore Employment tools →