SICK LEAVE & EMPLOYEE WELLNESS: CAN AN EMPLOYER LEGALLY DEMAND INTIMATE MEDICAL DETAILS FOR GRANTING SICK LEAVE?

INTRODUCTION

Employee health and wellness have taken center stage in contemporary work settings across the globe[1]. The modern-day workplace is increasingly characterized by physical and mental wellness initiatives covering flexible working hours, employee assistance programs, health insurance schemes, paid sick leaves, and wellness programs. Although the idea behind all these schemes is employee wellness, it also led to a serious legal issue as to how much medical information is needed by employers to offer sick leave to an employee.

The issue gained a lot of publicity during the COVID-19 pandemic when employers began requiring formal medical certificates, RT-PCR test results, proofs of vaccinations, and quarantine papers to justify absenteeism in their employees[2]. However, with the onset of the post-pandemic world, many employers have still continued to require any other medical documents including diagnostic reports, medical prescriptions, mental health records, pregnancy-related papers, information about fertility treatments and hospital discharge papers. With that, the important question arises: do employers have the right to require a medical history of their employees to authorize sick leave?

The category of medical information is highly sensitive in terms of personal data. On the contrary, the information concerning health can be said to be more important than ordinary records of employment, because it touches basic human rights of a man, such as bodily autonomy, dignity, and privacy. Revealing vital medical information may lead employees to discrimination, stigma, career misfortunes, and emotional burden. Thus, the statute aims to resolve a conflict of two opposite interests—the right of employer to avoid dishonest claims while keeping the employee’s right to privacy and confidentiality.[3]

In India, there is no law that regulates medical disclosures in terms of employment relations. However, the norms of law concerning the issue can be found in various sources such as constitutional provisions, law on labour relations, court rulings, jurisprudence of privacy law, rules concerning disabled people, protection of women in the labour market, etc. These norms prove that the employer can check the reason for an employee’s illness, but it should not have an unlimited access to sensitive medical records.[4]

The significant decision made by the Supreme Court in the case of Justice K.S. Puttaswamy (Retd.) v. Union of India[5] has changed legal principles, making sure privacy is considered a basic right of people. The judgement emphasizes informational privacy, providing that private medical details of a person are entitled to constitutional protection from any kind of unwarranted interference. This situation obliges employers to abide strictly by legal rules referring to collecting, keeping, and using people’s medical data.[6]

Organizations are concerned about practical issues. Employers must guarantee productivity in the workplace, avoid misuse of sick leaves, provide safety for their employees, and follow relevant laws concerning their employees’ occupational health. Some jobs are more sensitive than others, which requires closer medical investigation in such areas as public safety, work in hazardous conditions, provision of health care services, work in aviation, military service, and work with heavy machinery. Thus, the law does not ban employers from demanding medical evidence to some extent but obliges them to follow the principle of legality, necessity, proportionality, and confidentiality when it comes to collecting medical information.

WHY EMPLOYERS NEED MEDICAL INFORMATION ?

Providing employees with medical leave is not just a matter of paperwork. Employers also have to think about the financial, operational, and legal aspects involved in pretty much the process of giving an employee his leave. Employers want to know whether their employee has indeed been sick.

Employers looking for medical information may have legitimate reasons for this: to check if the employee was sick, to prevent misuse of paid sick leave, to keep the workplace safe, to arrange health insurance reimbursement, to follow the workforce regulations and various other purposes[7]. Medical tests may also be required in some industries to protect public safety.

Though, it should be noted that there is fine line between requesting proof of sickness and asking for specifics of the illness.

For example, an employer may ask an employee to provide a medical certificate to show that the employee was unable to work for a given period. The certificate usually indicates the period of illness and the incapacity of the employee to perform his/her work duties; however, it usually does not specify the diagnosis. On the contrary, sometimes the employer may require pathology tests, MRI scans, psychiatric assessments, fertility treatment, test results for HIV, cancer, or complications associated with pregnancy.

The legality of such requirements depends on the principle of necessity and proportionality.[8] This means that employers should collect only the information that is needed for a legitimate purpose. Any requests that go beyond this requirement is considered an invasion of one’s privacy.[9]

For instance, when an employee is diagnosed with a viral fever and submits a medical certificate for five days, it is against the law for the employer to ask for blood tests or prescriptions. Likewise, in case of depression, the employee may be asked to produce proof of his or her temporary incapacity for work, however, querying a therapist’s notes would be a violation of the employee’s rights to privacy.

Thus, what separates validation from interference is the concept at the center of employee privacy rights. Employers can track violations of sick leave policy however; they cannot access personal information that is not required for fulfilling such purpose according to the law.

CAN AN EMPLOYER LEGALLY DEMAND INTIMATE MEDICAL DETAILS FOR GRANTING SICK LEAVE?

One of the key problems with the employer-employee relationships is that they are often plagued with issues arising from mistrust. Employers cannot be fully trusted to be fair and impartial while regulating the attendance of workers, making their sick leave policies, and verifying sick leave applications. This, however, does not mean that employees have no rights and their rights become null and void once they start working in a company.

A proper example is an employer is allowed to ask an employee for a medical certificate issued by a registered doctor that shows that the employee was unable to work for an announced period. This document allows an employer to prove the disease of their employee and accept the leave application. However, when an employer affirms the necessity of offering detailed medical diagnoses, medical analyses, medical examinations, pregnancy complications, or a history of medical tests in order to approve an ordinary sick leave the limits of leave verification have definitely been exceeded.

While there is no any particular employment act that sets out the coverage of medical disclosures in India, it would be incorrect to conclude that employers can act without any limitations in this area. In fact, Indian legislation is rather strict in applying rules related to the collection, usage, and storage of medical information about the employees and poses serious legislative restrictions on it as medical information is considered as one of the most vulnerable categories of personal information.[10]

Employee Rights concerning medical information :

When an employee requests a sick leave, it is not merely a contractual right, but also provides the individual with a number of constitutional and statutory rights. These rights provide a framework for employers to achieve a fair balance between discipline in the workplace and individual privacy.

Right to Confidentiality of Medical Information :

Confidentiality of medical information is one of the accepted principles of medical ethics and jurisprudence in India[11]. Any information revealed to a medical practitioner by a patient is normally considered as confidential and cannot be further disseminated without the consent of the patient or on account of some legal provision or necessity of the public interest.

The principle of confidentiality also applies to employment relationship as well. In the event that an employee provides a medical certificate to the employer, it can be assumed that the information shared is only for the narrow purpose of leave processing. Therefore, reasonable protection of such information in a confidential manner is expected from employers and they are under obligation that information would not be shared with the colleagues, superiors or outsiders without any legal justification.[12]

However, the reality often appears to be otherwise. In many cases, employees are required to send medical certificates through email groups or disclose the nature of their illness to several members of the management. Such actions may not only violate confidentiality of information but also lead to legal consequences for the employer such as abuse of private information.

Right to Privacy :

The available protection for employees is that of the Right to Privacy, which is one of the fundamental rights as per Article 21 of the Constitution of India[13]. The nine-judge Constitution Bench in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1,[14] held – in a historic judgment – that Privacy is an integral part of life and liberty protected by Article 21. The Court also recognised the importance of informational privacy as a significant aspect of this right and stated that an individual has the right to manage flow and use of personal information such as medical records.[15]

The judgment was directed towards actions of the State, but the principles laid down in the judgment have had a significant impact in the field of employment. Employers have to observe the constitutional norms while formulating policies in relation to employees. It means that it is not enough to demand the medical information as such from employees; the process involved in the obtaining of this information must follow – the principles of legality, necessity, and proportionality in the actions of the employer. The employer’s needs must be satisfied with the help of an ordinary medical certificate in case where demanding of detailed medical records seems to be irrational and nonproportionate violation of the employee’s right to privacy.

Right to Dignity and Bodily Autonomy :

Every person has the right to live respectfully according to Article 21[16]. Human dignity includes bodily autonomy, freedom from intrusion, and other fundamental aspects of life.[17] Health problems relate to some of the most intimate aspects of life, as diseases often relate to the sense of self.[18] This is why the requirement of making employees share those details without a valid reason can violate their dignity and put them at risk of discrimination at work.

The Supreme Court has recognized the major role of dignity in human rights legislation[19]. Because of this, procedures requiring employees to reveal their medical information may breach the constitutional guarantees provided by Article 21.

Right Against Discrimination :

Employees suffering from chronic health problems, disabilities, mental health problems, pregnancy-related problems, or contagious diseases are very often victims of discrimination in the work place[20]. Excessive medical disclosure obligations can worsen an already existing situation, as they allow employers to make decisions based on the illness of the employee instead of on the professional qualities of the employee.

The Indian legal system has made considerable progress in preventing such discriminatory behaviour. It is stated that all medical information that was collected only for the purpose of granting a sick leave should not affect employer’s decisions on promotion, transfer, performance evaluation and employment terminations unless the employee’s condition affects his/her ability to perform essential duties of the job and the employee has expressly permitted to disclose any information about his/her health.

Right to Refuse Unnecessary Medical Disclosure :

Despite being bound by laws and contracts to follow reasonable employer guidelines, workers are not obliged to divulge all of their medical background. Employees do not have to comply with a request if it sounds unreasonable and outside the circumstances of the leave.

For instance, requiring an employee to submit a fitness report after taking sick leave owing to major surgery can be a valid requirement. However, asking for reports of his or her psychiatric counselling sessions, infertility treatment, result of HIV testing, or hospital history for a few days of sick leave would usually be unreasonable unless proven otherwise by means of compelling necessity.

To conclude, the law should be looked at from the necessity and proportionality angles. Employers can collect only those details necessary for the confirmation of the employee’s incapacity for work. [21]Any request which goes further than that should be supported by clear legal grounds and should not be used for the invasion of employee’s personal life.

MEDICAL CERTIFICATE VERSUS MEDICAL HISTORY: WHERE DO WE DRAW THE LINE?

The tension surrounding sick leave arises primarily from the confusion between the verification of illness and disclosure of diagnosis.

A medical certificate is usually issued for:

• noting that the employee has been assessed by a qualified physician;
• indicating that the employee is unfit to perform his duties due to illness;
• explaining how long the rest is recommended for; and
• informing, when required, whether the employee should return to work.

These data are quite enough to process sick leave applications. However, unlike medical certificates, diagnostics report, prescriptions, laboratory tests, X-ray reports, counselling notes, and treatment regimens contain sensitive information about the patient’s health, which is usually not necessary for standard administrative purposes.

Thus, while the employers are entitled to check the authenticity of the sick leave, they are not entitled to go on exploring the employee’s medical history in-depth. The law aims to strike a balance and allows reasonable checking of sick leave while protecting the employee’s right of privacy.[22]

A LEGAL FRAMEWORK ON MEDICAL PRIVACY AND THE RIGHT OF AN EMPLOYER TO OBTAIN MEDICAL INFORMATION

While, there is currently no Indian employment law that covers solely the issue of disclosure by employers in the healthcare context. Rather, the legal position arises from Constitutional provisions, labour law, data protection law, sectoral laws, contract law, and case law, a combined reading of several laws will make it clear to what extent an employer is authorized to collect, maintain and use the health information of the employee[23]. It is understood that although an employer has good reasons for wanting to know if an employee is actually sick, the employee still enjoys protection under law with respect to unnecessary sharing of medical information.

1. Digital Personal Data Protection Act, 2023

With the introduction of the Digital Personal Data Protection Act, 2023 [24](DPDP Act) India enters a new phase in its privacy journey. The Act does not relate only to employment issues, since it regulates any collection, processing, storage or distribution of an employee’s personal data through digital means. It also affects data related to health that is sent via email, HR portals, attendance software, etc.

However, in spite of the Digital Personal Data Protection Act, 2023 which does not include health information as a distinct type of “sensitive personal data,” health information is very privacy-sensitive and has to be processed for legal purposes only, adhering to the general principles of personal data processing under the Act. Thus, while collecting that data, the employer becomes a Data Fiduciary (and the employee becomes a Data Principal), which means that the legislation requires сompliance with the law and allows the processing of personal information by the employer only in a fair manner and for legal purposes[25].

The main principle of the DPDP Act is the principle of purpose limitation. [26]It allows an employer to collect employee data only for lawful employment-related purposes. That is why, if the employer solicits medical data in order to check the employee’s right to sick leave, it cannot be used later for other aims unrelated to such solicitation such as monitoring performance, making promotion decisions, conducting disciplinary profiling

Another vital concept of the DPDP Act is data minimisation. In this regard, it should be underscored that employers must collect only relevant information. For example, if the purpose is simply to confirm that the employee is officially on sick leave, it might usually be enough to provide a medical certificate stating this fact. However, if the employer insists on additional documents such as pathology results, mental health assessments, infertility treatment documents, or other medical records where none of these is necessary, this might violate the provisions of the relevant legislation.

The DPDP Act also requires employers to implement reasonable protective measures ensuring that employee personal data stays protected[27]. Medical records must be accessible only to the authorized personnel and stored properly. Nevertheless, in practice, employees are often made to send medical certificates via WhatsApp or shared office emails, posing ratter serious threats to data confidentiality.

2. The Mental Healthcare Act, 2017

The Mental Healthcare Act of 2017 greatly enhances the legal protection granted to people receiving mental healthcare. Even though the Act mainly regulates mental healthcare institutions and mental healthcare professionals, it also has significance in employment practices regarding the situation of an employee’s mental health status.

Section 23 of the Mental Healthcare Act enshrines the right to confidentiality in respected people who suffer from mental illnesses[28]. Mental health information, such as details about health care, mental illnesses diagnosis, therapy notes, or psychological evaluations, is absolutely confidential and cannot be disclosed in any case except for specially allowed cases.

Moreover, an employer is entitled to require reasonable proof about the fact that an employee was unfit for work due to mental health issues.

The Act provides an important legislative purpose that is to help people to consult mental health professionals without fearing discrimination or discrimination because of their illnesses.[29] Otherwise, unemployed requests for medical records may lead to employees’ reluctance to seek treatment and follow wellness programs.

3. Rights of Persons with Disabilities Act, 2016

The Rights of Persons with Disabilities Act, 2016[30] (RPwD Act) provides another legal protection for persons with disabilities or chronic illnesses working for institutions. This Act bans discrimination against persons with disabilities and mandates that employers provide reasonable accommodation to employees to the extent possible.

Several disabilities, recognized by the Act, including autism spectrum disorder, multiple sclerosis, Parkinson’s disease, specific learning disabilities, chronic neurological disorders, mental illnesses, and blood disorders, may need employees to take leaves for medical reasons from time to time. However, the employer’s responsibility to provide reasonable accommodation cannot be a reason for them to require unrestricted access to the relevant medical records.

When an employee contacts the employer asking for accommodation or medical leave, the employer can ask for evidence of a disability and information about the accommodation required from the employee; however, it shouldn’t ask for too much medical evidence unrelated to any of the employee’s job functions. The RPwD Act aims to ensure inclusion and not to exploit employees with disabilities affected by any intrusive medical examinations.

4. The Maternity Benefit Act of 1961[31]

Medical confidentiality is even more crucial in instances of pregnancy and reproductive health matters. The Maternity Benefit Act of 1961 provides statutory maternity leave and maternity benefits to deserving women employees. In order to receive the benefits, the employee may be called upon to show a medical certificate attesting to her condition of pregnancy or expected delivery.

But the Act does not allow an employer to require a woman employee to disclose sensitive and intimate information related to her reproductive health or infertility treatment including IVF, miscarriage history, or hormonal issues.

Pregnancy information is very personal and is closely related to a woman’s dignity, bodily integrity, and reproductive freedom.[32] Hence, it is imperative for employers to ensure that the medical information they obtain concerning medical or maternity leave is restricted to legally permissible limits and kept confidential.

5. Labour Laws, Service Rules and Company Policies

In addition to the aforementioned legislations, actual governance of sick leave often relies upon employment contracts, the service rules, the certified standing orders and the State Shops and Establishments Acts. Most companies require employees wishing to take sick leave for more than a prescribed period to present an original medical certificate given by duly registered medical practitioner.[33]

It should be noted that these instructions usually stipulate that an otherwise ‘certified’ employee be able to present just a proof of his/her incapacity and not the full information of his/her medical condition and treatments. On the other hand, except for those cases where the job involves some highly sensitive tasks, such as driving, military service, health care, mining and other dangerous jobs, an employee is not necessarily obliged to share the information concerning his/her ailment or any treatment.

As a result, in this situation, the employers need to make sure that their companies’ policies are in accordance with the provisions of law.

JUDICIAL APPROACH AND EXCEPTIONAL CIRCUMSTANCES: UNDER WHAT CIRCUMSTANCES CAN AN EMPLOYER REQUEST MEDICAL INFORMATION?

The lack of a separate law on employment relations regarding the medical information has led Indian courts to have a key role in determining the limits of the employer’s legitimate interests on the one hand and the employee’s right to privacy on the other. Although the Supreme Court has not yet provided an explicit answer on whether it is permissible for the employer to require private medical information to be able to grant the leave due to illness, it has given an appropriate direction concerning the notions of privacy, medical secrecy, human dignity, and bodily integrity.

JUSTICE K.S. PUTTASWAMY (RETD.) V. UNION OF INDIA (2017): PRIVACY INVOLVES MEDICAL RECORDS.

The basis of employee medical privacy was laid down by Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1[34] in which a nine-judge Constitution bench held the Right to Privacy as a fundamental right under Article 21 of the Constitution.

A noteworthy highlight of the judgment is the introduction of informational privacy which signifies that an individual must be able to control the collection, use, and distribution of his/her personal information. The Court clearly stated that medical information is one kind of very personal information that could be protected.[35]

The Court states that privacy provides control to a person over himself/herself and decisions concerning his/her life. Although the right is not absolute, its limitation must fulfill the conditions of legality, necessity, proportionality, and the requirement of the process.[36]

Using these principles when dealing with employer-employee relationships, it is possible to verify the health of a sick employee. However, providing intimate health information for the approval of a sick leave may not be proportional, given the availability of less invasive options, such as the medical certificate.

Therefore, the ruling in the Puttaswamy case changes the legal question from “Is it acceptable for an employer to demand health information?” to “What information is really needed?”

1. X V. HOSPITAL Z (1998): MEDICAL CONFIDENTIALITY IS THE RULE

A significant ruling related to medical confidentiality is Mr. X v. Hospital Z, (1998) 8 SCC 296. In this case, the plaintiff’s HIV positive status was revealed without his knowledge, leading to the termination of his marriage proposal. The Supreme Court ruled that medical data is normally confidential and is part of a person’s right to privacy, but the Court also acknowledged that confidentiality could be breached in special situations to safeguard another person’s life or health.

Even though the Court allowed disclosure in this particular case, the ruling served to affirm an important legal principle that medical confidentiality remains a legal rule and disclosure is an exception[37].

SUCHITA SRIVASTAVA V. CHANDIGARH ADMINISTRATION (2009): RIGHT TO BODILY AUTONOMY

In Suchita Srivastava v. Chandigarh Administration (2009), the Supreme Court confirmed that reproductive autonomy forms an important element of personal liberty as per the provisions of Article 21.[38] The court recognized that the matter involved reproductive rights, but explained that everyone has the right to take decisions regarding one’s own body without any kind of interference.

The court’s findings have great significance in the context of employment since the trend is for employers to refrain from asking employees to disclose their pregnancy problems, infertility treatment or any other intimate medical condition unless it is relevant for claims based on statutory entitlements.

X VERSUS PRINCIPAL SECRETARY, HEALTH AND FAMILY WELFARE DEPARTMENT Government of NCT of Delhi (2022) 10 SCC 1, PRIVACY SAFEGUARDS OUR REPRODUCTIVE CHOICES.[39]

In this case, the Supreme Court broadened the horizon of privacy law even further. The Court said that reproductive choices, health care decisions, and access to health care are all covered under dignity, privacy, and right to make choices: “this is indeed quite significant, since it recognizes the right to privacy of reproductive information.”

It should be noted that for employers, this judgment highlighted the fact that confidentiality of medical condition relating to pregnancy, miscarriage, or other reproductive health issues should not be a subject of unnecessary inquiries at the workplace when an employee requests a medical leave.

WHEN THE USE OF MORE MEDICAL INFORMATION MIGHT BE ACCEPTABLE

In general, ordinary employers do not have the right to request any confidential medical information from their workers. Nevertheless, there are some exceptional cases when demand for more medical information may be fully justified legally.

One such case is safety-sensitive jobs. Those who work as pilots, drivers, surgeons, firefighters, military officers, machine operators, or workers with hazardous materials perform their work in a public space.[40] In this case, it is acceptable for employers to require more detailed medical assessment to assess the employee’s fitness for work.

Another case is when an employee applies for reasonable accommodation under the Rights of Persons with Disabilities Act, 2016. Then, it might be necessary for employers to ask for some medical documentation to show the nature of the disability. However, in this situation, employers should refrain from requiring full medical histories as much as possible.

Furthermore, regulatory obligations arising under workplace safety legislation, insurance requirements, and special profession fitness criteria may impose an obligation on employees to provide additional medical information. Yet, even in these situations, employers will still be guided by the laws of confidentiality, necessity and proportionality.

As a result, the conclusion that can be drawn from court decisions is unambiguous: the bigger the invasion incurred by a company into the employee’s medical privacy, the more serious justification should be provided by the employer. Administrative convenience cannot justify getting unlimited access to confidential medical records.

As Indian privacy law continues to develop, employers will need to adopt a rights-based approach in order to retain employee dignity while protecting their own important interests. Medical verification should remain a tool of accountability, but not a way of unnecessary invasion into employees’ private lives.

Additional severance might be justified in some cases of pandemic outbreaks. For instance, the COVID-19 pandemic made it necessary for employers to demand vaccination certificates, COVID-19 test results, or other quarantine documents to follow the public health requirements.

REMEDIES OF EMPLOYEES AVAILABLE IN CASE OF UNLAWFUL MEDICAL DISCLOSURE

If there is no specific employment statute regulating medical disclosures, it does not mean that employees do not have legal remedies. Where an employer is asking for unnecessary medical information, holding confidential medical records without justification, or disclosing information to others, the injured employee may have constitutional, statutory, contractual, and civil remedies depending on the violation.

The first remedy usually comes from inside the organization itself. Employees may inquire about the policy at the Human Resources Department regarding the legal foundation for demanding some medical records and whether the information asked is necessary for processing sick leave. If the employer’s internal leave policy provides for a medical certificate only, insistence on more information in the form of diagnostic reports and treatment records might be a violation on the part of the employer.

Employees may be guided by the principles laid down in the Digital Personal Data Protection Act, 2023,[41] especially where health information is collected or processed online. As Data Fiduciaries, employers are supposed to collect personal information only for valid and specified purposes, apply adequate security measures, and refrain from processing any unnecessary personal data. While the practical implementation of the law is still under development, it is evident that it is the stance of the Parliament that the sensitive data, especially medical information should not be collected without justification.

When the disclosure of health information causes discrimination, harassment, denial of promotion, or any other negative consequences at work, such actions may be attacked by employees, depending on the specifics of their employment and the regulations in force. To be more precise, public sector employees can invoke constitutional protection in accordance with Articles 14, 19, and 21 while in case of labour situation, the employees may seek legal remedy before labour authorities and other relevant organizations if the conduct of employer falls into the category of unfair labour practices or unreasonable exercise of management authority.

Likewise, workers who face physical disabilities or mental health problems may rely on protections under the Rights of Persons with Disabilities Act, 2016, as well as the Mental Healthcare Act, 2017, where revealing confidential medical information leads to discrimination or refusal to grant the employee due rights.

In addition to statutory measures, employers can also become liable under contracts. Employment agreements, confidentiality policies, employee manuals, or corporate policies often include requirements for the protection of employee data. Unauthorized revelation of personal information therefore may amount to violation of terms of the contract and compel the employer to face liability outside of the courts.

Thus, although employers may possess the right to check the authenticity of an employee’s health condition, any such checks will remain subject to restrictions imposed by the Constitution, as well as to employer’s obligations provided under law and need to respect the confidentiality of their staff.

EMPLOYERS’ GUIDE TO DEVELOPING SICK LEAVE POLICIES IN ACCORDANCE WITH PRIVACY REGULATIONS

With the rise of digital HR technologies and wellness programs at the workplace, responsibilities regarding maintaining employee health data do not end with legal compliance, but rather are part of the sound governance practices of modern corporations. It is necessary to note that transparent and privacy-compliant leave policies are an important condition for enhancing the employees’ trust and minimizing the risk of facing legal issues.

To start with, it is important for employers to distinguish between the sickness verification and medical information collection. For regular sick leaves the duly issued certificate from any licensed medical specialist should be sufficient unless the job in question requires further verification. It is also necessary to specify in the internal leave policies the instances when other medical documents need to be provided and the underlying reasons for such requests.

To proceed with, it is important for the employers to follow the principle of minimum necessary disclosure. The role of the HR department is to collect only medical information that is required for processing the leave payments. For instance, the demands for the medical diagnosis report, prescriptions, pathology reports, psychiatric history, reproductive health details, or the full medical record of the patient should be avoided unless there are justifying legal obligations or real necessity in the specifics of the job.

Every workplace medical policy should be based on confidentiality. There must be limited access to the employee medical files and only authorized staff shall manage sick leave procedures and compliance with occupational health regulations. The medical procedures should not travel through informal communication options and should not be revealed to managers, coworkers, or third persons unless required by law.

Also, the organization shall train HR specialists on the principles of protecting workers’ rights, fulfilling their duties regarding privacy and confidentiality. In a considerable number of cases, violations of privacy take place not because of malicious intent, but as a result of lack of awareness about the sensitive nature of medical data.

It is also vital to create clear grievance mechanisms. Employees need to have a chance to contest requests that seem unreasonable without the fear of being punished. Internal complaint procedures are necessary for making sure that fairness is guaranteed in the resolutions of complaints.

Lastly, organizations must evaluate their employment contracts, leave policies, and data protection systems at regular intervals to guarantee compliance with the changing constitutional jurisprudence and legislative changes. Proactive compliance with privacy laws will become more significant in the aspect of governance in employment as privacy laws are evolving in India.

CONCLUSION

The increasing concern regarding employee wellness has changed the health-employment connection in a fundamental way.[42] It is true that the employer has a legitimate need to establish the legitimacy of the sick leave and prevent abuse of employee benefits, however, this cannot be treated as the reason to get unrestricted access to the confidential medical data of an employee. Employment does not take away the constitutional rights of an individual and does not allow the employer to ask for intimate details of the employee’s health status of either physical or mental character as a prerequisite for granting medical leave.

Indian legislation may be somewhat disjointed in terms of its constitutional principles, labour laws, court practices, and data protection laws, yet it is uniformly advocating for the balanced approach. The actual rulings based on the famous case of Justice K.S. Puttaswamy (Retd.) v. Union of India leave no doubt in the fact that medical information is classified among the information protected by the right to informational privacy. The latest Digital Personal Data Protection Act, 2023 confirmed this point by stating that personal data can be collected only for legitimate and appropriate goals, while laws concerning specific sectors of activity like Mental Healthcare Act, 2017, the Rights of Persons with Disabilities Act, 2016, and the Maternity Benefit Act, 1961 should be mentioned.

Thus, employers may require acceptable evidence that the employee is physically unfit to work, but they are not allowed to require disclosure of the diagnosis, treatment, psychiatric assessment, pregnancy health information, or any other private medical details unless this becomes incumbent by law, necessary for workplace safety, or practically useful for achieving a bona fide business goal.

The future of employment laws lies not in promoting employer surveillance, but in establishing trust and respect in the workplace[43]. The sick leave policies that ensure the compliance with privacy laws, restrict the collection of personal medical data, introduce strict confidentiality measures, and involve transparent HR processes allow employers to verify the cases of genuine illness without violating the employees’ constitutional rights. An effective system of well-being of employees ensures the compliance with both the interests of the organization and the principles of autonomy, dignity, and right to privacy laid down in the Indian Constitution.

FREQUENTLY ASKED QUESTIONS (FAQS)

1. Is it permissible for my boss to request my health records to process my sick leave?

As a rule of thumb, it isn’t. A company can ask for reasonable evidence of illness, like a sick leave note from a legitimate health professional. However, obtaining detailed health records, medical details, or full history without good grounds to require it may be deemed inappropriate and in violation of employee privacy rights.

2. Is a sick note enough for calling in sick to work?

For the most part, yes. A medical note proving that you were sick and recommending you to take sick leave is usually enough. Further medical data may only be required if it is necessary because of the inherent nature of the job or particular legal needs.

3. Is it legal for my employer to insist that I tell him what my exact diagnosis is?

As a rule, no. In some cases, while an employer may make any checks to ensure your illness, he cannot require you to disclose your exact diagnosis, treatment, or confidential medical issues until it is related to your job.

4. Is the employer entitled to access my mental well-being reports or counselling records?

No, in most cases. The mental health records are extremely private and fall under the provisions of the Mental Healthcare Act, 2017. An employer can always ask for the fitness certificate if necessary but can usually not demand psychiatric evaluations, therapy records or counselling notes as a prerequisite for giving sick leave.

5. May an employer inquire into pregnancy, fertility treatment or miscarriages in order to approve a sick leave?

Only in cases where such information is needed in order to provide statutory benefits as defined by the Maternity Benefit Act, 1961. The employer should not make any other intimate inquiries related to reproductive health, fertility treatment or miscarriage as part of the procedure of granting regular sick leave.

6. What if my employer requires me to provide excessive medical information?

First, you may examine your employment contract and sick leave policy of the company in order to see what kind of documentation is really required. In case if you think that the employer is requesting too much documentation, you may always ask for further clarification from the HR department or even get some legal advice.

7. Is my employer allowed to disclose any of my medical details to any other employees or management?

In most cases, no. Any medical detail is supposed to remain confidential and accessible only to authorised persons who have the need to access the information due to work-related purposes. The disclosure of the information without the authority may result in invasion of privacy and lead to legal problems.

8. Are there circumstances when an employer is entitled to request more medical information from an employee?

Yes. More medical information may be needed where the kind of work done by the employee poses a risk to the health of the public, such as air traffic control jobs, health care jobs, defence jobs, mining jobs, and machinery jobs.

9. Which are the statutes that ensure medical privacy of employees in India?

The medical privacy of employees in India is guaranteed by the following set of legal doctrines: Article 21 of the Constitution of India; the Digital Personal Data Protection Act, 2023; the Mental Healthcare Act, 2017; the Rights of Persons with Disabilities Act, 2016; the Maternity Benefit Act, 1961; and the privacy doctrine laid down by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India.

10. Whether can an employer terminate an employee if he or she refuses to disclose sensitive medical information about oneself?

Where an employee refuses to submit himself or herself to reasonable and lawfully required medical tests, an employer is entitled to take disciplinary measures. Nevertheless, whether the dismissal or other disciplinary sanctions against an employee for the refusal to share sensitive medical information will hold up legally in court remains doubtful, especially in situations where the demands of the employer were not proportional or statutory in nature.

 

[1] International Labour Organization, Safety and Health at the Heart of the Future of Work: Building on 100 Years of Experience (2019).

[2] World Health Organization, Considerations for Public Health and Social Measures in the Workplace in the Context of COVID-19 (2023).

[3] Digital Personal Data Protection Act, No. 22 of 2023, §§ 2(t), 4–8, INDIA CODE (2023).

[4] Mental Healthcare Act, No. 10 of 2017, § 23, INDIA CODE (2017).

[5] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

[6] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, ¶¶ 297–325.

[7] International Labour Organization, Managing Work-related Psychosocial Risks During the COVID-19 Pandemic (2020).

[8] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

[9] INDIA CONST. art. 21.

[10] Digital Personal Data Protection Act, No. 22 of 2023, §§ 4–8, INDIA CODE (2023).

[11] Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, Reg. 2.2.

[12] Mr. X v. Hospital Z, (1998) 8 SCC 296.

 

[13] INDIA CONST. art. 21.

[14] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

[15] Id.

[16] INDIA CONST. art. 21.

[17] Selvi v. State of Karnataka, (2010) 7 SCC 263.

[18] Common Cause (A Reg’d Soc’y) v. Union of India, (2018) 5 SCC 1.

[19] Suchita Srivastava v. Chandigarh Administration, (2009) 9 SCC 1.

[20] Rights of Persons with Disabilities Act, No. 49 of 2016, §§ 3, 20, INDIA CODE (2016).

[21] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

[22] Mr. X v. Hospital Z, (1998) 8 SCC 296.

[23] World Health Organization, Ethics and Governance of Artificial Intelligence for Health (2021).

[24] Digital Personal Data Protection Act, No. 22 of 2023, INDIA CODE (2023).

[25] Digital Personal Data Protection Act, No. 22 of 2023, §§ 2(i), 2(j), 4–8, INDIA CODE (2023).

[26] Digital Personal Data Protection Act, No. 22 of 2023, §§ 4, 5 & 8, INDIA CODE (2023).

[27] Digital Personal Data Protection Act, No. 22 of 2023, § 8(5), INDIA CODE (2023)

[28] Mental Healthcare Act, No. 10 of 2017, § 23, INDIA CODE (2017).

[29] Mental Healthcare Act, No. 10 of 2017, pmbl., §§ 18–23, INDIA CODE (2017).

[30] Rights of Persons with Disabilities Act, No. 49 of 2016, §§ 3, 20, INDIA CODE (2016).

[31] Maternity Benefit Act, No. 53 of 1961, §§ 5–10, INDIA CODE (1961).

[32] X v. Principal Sec’y, Health & Family Welfare Dep’t, Govt. of NCT of Delhi, (2022) 10 SCC 1.

[33] Model Standing Orders, Industrial Employment (Standing Orders) Central Rules, 1946.

[34] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

 

[35] Id.

[36] Id.

[37] Mr. X v. Hospital Z, (1998) 8 SCC 296.

[38] Suchita Srivastava v. Chandigarh Administration, (2009) 9 SCC 1.

[39] X v. Principal Sec’y, Health & Family Welfare Dep’t, Govt. of NCT of Delhi, (2022) 10 SCC 1.

[40] International Labour Organization, Occupational Safety and Health Convention, Convention No. 155 (1981).

[41] Digital Personal Data Protection Act, No. 22 of 2023, §§ 8–13, INDIA CODE (2023).

[42] International Labour Organization, Protection of Workers’ Personal Data: An ILO Code of Practice (1997).

[43] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1; Digital Personal Data Protection Act, No. 22 of 2023.