Yes, you can sue your employer for disclosing your medical information in most cases, and the main federal vehicle is the Americans with Disabilities Act. The ADA requires employers to keep any medical information they collect in separate, confidential files, and sharing a diagnosis or medical restriction with people who have no legitimate reason to know it is itself a violation. To get into federal court, you first file a Charge of Discrimination with the Equal Employment Opportunity Commission, and if your case succeeds, federal damages are capped between $50,000 and $300,000 depending on the size of your employer.
When a Disclosure Actually Breaks the Law
The ADA’s confidentiality rule, found at 42 U.S.C. § 12112(d), covers medical information your employer gathers through post-offer physicals, fitness-for-duty exams, accommodation requests, and job-related inquiries about current employees.1Office of the Law Revision Counsel. 42 USC 12112 – Discrimination That information has to live on separate forms, in separate medical files, treated as a confidential medical record.2eCFR. 29 CFR 1630.14 – Medical Examinations and Inquiries Specifically Permitted Your records cannot sit in the same personnel folder a manager pulls up for a performance review, and they cannot be shared out to coworkers, clients, or other managers who play no role in your accommodation or safety.
The statute carves out three narrow exceptions:
- Supervisors and managers may be told about necessary work restrictions and accommodations, but only what they need to put those changes in place. “She can’t lift more than 20 pounds” is permitted; “she has a herniated disc from a car accident” is not.
- First aid and safety personnel may be informed when a disability could require emergency treatment.
- Government officials investigating ADA compliance can be given relevant information on request.
Everything outside those three categories is a potential breach. A supervisor telling the whole team about a colleague’s cancer diagnosis is the textbook violation. The breadth of the disclosure is what matters, not whether the supervisor meant any harm.
One wrinkle trips people up: voluntary disclosure. If you tell a coworker about a condition over lunch, that coworker has no federal duty to stay quiet because they are not acting as the employer’s agent. But when you share medical information with a supervisor, HR representative, or anyone with managerial authority, the EEOC’s position is that the employer’s confidentiality duty still attaches, even if you volunteered the information rather than responding to a formal medical inquiry.3U.S. Equal Employment Opportunity Commission. EEOC Informal Discussion Letter Telling your manager one-on-one does not license them to pass it to the department. Context still counts, though. If you announced a diagnosis at a company meeting or posted about it on social media, the argument that the employer invaded your privacy by discussing what you already made public becomes much harder.
Does the ADA Even Cover Your Employer?
The ADA’s employment provisions reach only employers with 15 or more employees in each working day of at least 20 calendar weeks in the current or preceding year.4Office of the Law Revision Counsel. 42 USC 12111 – Definitions Below that number, you have no federal ADA claim, though state law may still give you one.
HIPAA is the other common misconception worth clearing up. HIPAA regulates healthcare providers, health plans, and clearinghouses. It does not directly regulate employers that are not themselves covered entities.5U.S. Department of Health and Human Services. Am I a Covered Entity Under HIPAA If you handed a doctor’s note to HR and your boss repeated what it said, your claim almost certainly runs through the ADA, not HIPAA. Separate confidentiality rules exist for genetic information under GINA and for medical certifications submitted under the FMLA, but the most common workplace-disclosure scenario lands in ADA territory.
Evidence to Gather Before You File
Documentation separates a viable claim from a frustrating dead end. Start writing things down as soon as you learn the disclosure happened. The core facts: who disclosed the information, who received it, when it happened, and how the employer originally obtained the medical data.
Collect anything tangible. Emails that reference your condition, text messages, Slack or Teams messages, internal memos, screenshots. If coworkers are willing to confirm what they were told and by whom, record their names and the substance of what they heard. Witness accounts fill the gaps when the employer later claims the disclosure never happened or was authorized.
Pull your company’s privacy policies, employee handbook language, and any confidentiality acknowledgments you signed. When an employer violates its own written protocols, that record undercuts the defense that the disclosure was a reasonable business judgment.
Filing a Charge With the EEOC
You cannot walk straight into federal court. The ADA requires you to file a Charge of Discrimination with the EEOC first, and this step is mandatory. Filing is available through the EEOC’s online portal, in person at a local office, or by mail.6U.S. Equal Employment Opportunity Commission. How to File a Charge of Employment Discrimination
The deadline is tight. You generally have 180 calendar days from the date of the disclosure. That window stretches to 300 days if a state or local agency in your area enforces an equivalent anti-discrimination law, because the charge gets automatically cross-filed.7U.S. Equal Employment Opportunity Commission. Time Limits for Filing a Charge Miss these deadlines and the claim almost always dies.
Your charge should name disability as the basis, describe how the employer obtained the medical information, and explain the specific way it was improperly shared. List witnesses. An EEOC staff member helps prepare the formal document from the information you provide.
After filing, the agency notifies your employer, may offer voluntary mediation, and otherwise investigates. The investigation can take months. You do not have to wait it out: once 180 days have passed from filing, you can request a Notice of Right to Sue and proceed on your own timeline, and in some cases the EEOC issues the notice earlier if it cannot finish within that window.8U.S. Equal Employment Opportunity Commission. Filing a Lawsuit
Taking the Case to Federal Court
Once you receive the Notice of Right to Sue, you have exactly 90 days to file a civil complaint in federal court. The 90-day clock is set by statute, and courts rarely extend it. Miss it and you lose the right to sue under the ADA for that disclosure.8U.S. Equal Employment Opportunity Commission. Filing a Lawsuit
In discovery, your employer must produce internal communications, email chains, and access logs showing who touched your medical file and when. Cases built on solid documentary evidence gain real traction here, because the employer’s own systems often reveal exactly how far the information traveled.
What You Can Recover
Federal law caps the combined compensatory and punitive damages available under the ADA based on employer size:
- 15 to 100 employees: $50,000
- 101 to 200 employees: $100,000
- 201 to 500 employees: $200,000
- More than 500 employees: $300,000
These caps apply to future lost wages, emotional distress, mental anguish, and punitive damages combined.9Office of the Law Revision Counsel. 42 USC 1981a – Damages in Cases of Intentional Discrimination in Employment They apply per person, not per claim, so stacking theories does not multiply the ceiling. Back pay and front pay are not capped and can add significantly to the total. Courts can also order the employer to cover your attorney’s fees and litigation costs. Punitive damages require showing the employer acted with malice or reckless indifference to your rights, a higher bar than simple negligence.
Protection From Retaliation
Filing a charge or lawsuit triggers a separate layer of protection. Under 42 U.S.C. § 12203, your employer cannot fire you, demote you, cut your hours, or take any other adverse action because you opposed the privacy violation or participated in an EEOC investigation.10Office of the Law Revision Counsel. 42 USC 12203 – Prohibition Against Retaliation and Coercion The statute also forbids coercion and intimidation meant to discourage you from pursuing your rights. Retaliation becomes an additional claim with its own damages, and these claims are often easier to prove than the underlying discrimination because the timing alone can be powerful circumstantial evidence.
When State Law Is the Better Route
Federal law sets the floor. Many states have their own workplace privacy statutes, medical confidentiality laws, or common-law causes of action like public disclosure of private facts. State claims can run alongside a federal ADA case and sometimes offer real advantages: lower employee-count thresholds, no administrative exhaustion requirement, no damage cap, or longer statutes of limitations. HIPAA does not preempt state laws that provide stronger privacy protections.11U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
If your employer has fewer than 15 employees and falls outside the ADA, state law may be your only avenue. Given the federal damage caps and the short 90-day lawsuit window, talk to an employment attorney licensed in your state early. The right combination of federal and state claims depends on the facts, and the deadlines will not wait while you figure it out.