Can an Employer Share Your Medical Certificate With Other Staff?

An employer should not circulate an employee's medical certificate to other staff merely because the document was submitted for sick leave. Health information is sensitive. Access should generally be limited to people who genuinely need information to administer leave, payroll, workplace safety, capacity, adjustments or a lawful claim.

Some internal sharing can be legitimate. HR may need to retain the certificate, payroll may need approved dates, and a manager may need functional restrictions to plan safe duties. Those people rarely need the employee's complete diagnosis or a copy of every clinical detail. Coworkers usually need only operational information, such as that the employee is on approved leave or has temporary duty limits.

Australian privacy coverage is complex. The federal Privacy Act has an employee-records exemption for certain acts of private employers, while public sector, state or territory laws, health-record laws, contracts, policies and confidentiality duties may also apply. This article is general information, not legal advice.

Key Points

• A medical certificate should not be broadly shared across the workplace.
• HR, payroll or a responsible manager may need limited access for legitimate employment purposes.
• Coworkers generally do not need the certificate or diagnosis.
• Operational messages can state approved absence or restrictions without naming the condition.
• The Privacy Act employee-records exemption is limited and does not erase every confidentiality duty.
• Public sector and state or territory privacy rules can differ.
• Employers should use least-access storage, clear retention and secure disposal.
• Employees can ask who accessed the document and why it was disclosed.

Medical Certificates

Who May Need Information Internally?

The appropriate audience depends on the purpose. A small number of authorised people may need some information:

• HR may verify evidence, record leave and manage a capacity process;
• payroll may need the approved dates and ordinary hours;
• a direct manager may need the expected absence and work restrictions;
• a return-to-work coordinator may need functional capacity information;
• work health and safety staff may need information connected to a specific risk; and
• legal or claims personnel may need relevant records for a lawful dispute or insurer process.

Need does not automatically mean each person needs the full document. Payroll can often act on an approved leave code. A supervisor can implement “no lifting above five kilograms” without knowing the diagnosis.

Dociva's medical certificate request pillar explains when evidence may be requested. This page focuses on what should happen after submission.

What Coworkers Usually Need to Know

A team may need to redistribute work, adjust a roster or know when someone is expected back. That can usually be communicated without health details: “Sam is on approved leave until Thursday” or “Sam will perform modified duties for two weeks”.

Sharing that an employee has depression, pregnancy complications, cancer, an infectious condition or another diagnosis merely to satisfy workplace curiosity is generally inappropriate. Even a well-intentioned message can expose the employee to gossip, stigma or discrimination.

The Fair Work workplace privacy guide says it is generally inappropriate to disclose private information such as a current or former employee's medical history. Good practice is to have a clear policy and consider consent before disclosure.

If coworkers need safety instructions, communicate the instruction rather than the diagnosis whenever possible. For example, identify cleaning, isolation or task controls without attaching the certificate to a group chat.

The Federal Employee-Records Exemption

It is inaccurate to say that the Australian Privacy Principles govern every employer's handling of every certificate in exactly the same way. The OAIC employee-records exemption guidance explains that a private-sector employer's act or practice may be exempt when it is directly related to a current or former employment relationship and an employee record it holds.

Health information and leave information can form part of an employee record. However, the exemption is not a blanket permission for any use. An employer selling employee data for marketing, a contractor handling another organisation's employee records or conduct outside the direct employment relationship may not be covered.

Australian Government and many state or territory public sector employers operate under different privacy regimes. State health-privacy laws can also be relevant. Organisations should obtain advice about their location, sector and record flow rather than assuming “employee records are exempt” ends the analysis.

Confidentiality Still Matters

Even where the federal employee-records exemption applies, contracts, workplace policies, enterprise agreements, professional duties, equitable confidentiality principles, discrimination laws and work health and safety obligations may affect disclosure. Poor handling also creates significant trust, wellbeing and industrial risks.

The Australian Human Rights Commission's workplace mental health guidance advises employers not to tell colleagues about a worker's condition without agreement and suggests communicating only work-relevant details.

A certificate is supplied for a limited purpose: usually evidence of incapacity, caring responsibility or work capacity. Using it for gossip, team explanation, unrelated performance commentary or public discussion can exceed that purpose.

Dociva's guide to HR confidentiality examines storage and access controls in more detail.

Diagnosis Versus Functional Information

Most ordinary absence certificates can confirm that an employee was unfit for work for stated dates without naming the diagnosis. A return-to-work process may need more functional information, such as lifting limits, hours, concentration requirements or review dates.

Functional information can be shared with the manager who must implement it. It still should not be distributed beyond people responsible for the plan. The underlying diagnosis may remain with HR or the clinician unless a lawful and necessary reason requires disclosure.

Read whether a medical certificate must state a diagnosis and what an employer can ask about illness. Both help separate evidence of entitlement from unnecessary clinical detail.

When Wider Disclosure May Be Lawful

There can be situations where information must or may be disclosed beyond the ordinary leave team. Examples can include a legal obligation, court order, workers compensation or insurance process, serious and imminent safety concern, regulatory investigation or disclosure authorised by the employee.

The legal basis and scope matter. A requirement to give a record to an insurer does not automatically authorise publication to coworkers. A safety need may justify sharing a restriction with a supervisor without sharing the full diagnosis.

Where consent is used, it should be informed and specific: who will receive what information, for which purpose and for how long. Employees should not be pressured to sign a broad release that is unrelated to the decision being made.

Consent Should Be Specific, Not Assumed

Telling one manager about a condition is not automatic consent for that manager to tell the team. Giving HR a certificate for leave is not automatic consent to use it in training, a reference or an unrelated performance discussion.

If broader disclosure would genuinely help, ask the employee first and record the agreed wording, audience and purpose. The employee might consent to colleagues knowing a temporary adjustment while preferring that the diagnosis remains private.

Consent can also be withdrawn for future optional sharing, although it cannot always reverse a disclosure already made or override a separate legal obligation. Managers should check with HR before relying on informal comments such as “I do not mind if people know”.

Book Online Consultation

Secure Storage and Access

Medical certificates should be stored in a controlled HR or leave system, not an open shared drive, roster folder or team mailbox. Role-based access should reflect actual job duties, and access should be removed when a person changes roles.

Good handling includes secure transfer, access logs where available, retention rules, backups, protection from accidental email forwarding and secure disposal when records are no longer required. A manager who receives a certificate by text should transfer it through the approved channel and remove unnecessary copies according to policy.

The OAIC health information overview explains that health information is sensitive information. Organisations covered by privacy laws should apply safeguards proportionate to that sensitivity.

The employee should use the employer's secure upload or HR channel where one exists. Avoid sending the certificate to a broad distribution list or posting it in a team collaboration channel.

Common Inappropriate Sharing Examples

Team email: a manager forwards the certificate to explain why a shift is uncovered. The team only needed the absence period.

Group chat: a supervisor posts a photo of the certificate and asks whether coworkers believe it. Authenticity concerns belong in a confidential HR process.

Open roster note: a diagnosis is entered beside the employee's name. “Approved personal leave” would usually be enough.

Office conversation: HR discusses the medical details within hearing of unrelated staff. Physical confidentiality matters as much as system access.

Overbroad return plan: the full report is distributed to every supervisor when only two restrictions are relevant.

Appropriate Limited-Sharing Examples

Payroll: receives approved leave dates and hours without the clinical narrative.

Direct manager: receives expected return and documented task restrictions needed to roster safely.

Return-to-work coordinator: receives a capacity certificate because they administer the plan and claim.

First-aid or safety lead: receives a specific emergency instruction with the employee's knowledge where relevant to workplace safety.

External adviser: receives necessary records under an appropriate legal, contractual and confidentiality framework.

If Your Certificate Was Shared

1. Record what was shared, by whom, with whom and when.
2. Keep the email, screenshot or witness details without redistributing it further.
3. Ask HR for the purpose and authority for the disclosure.
4. Request containment, deletion of unnecessary copies and correction of access permissions.
5. Review the workplace privacy, grievance and data-breach policies.
6. Ask which privacy law or employee-record rule applies to the employer.
7. Seek union, legal, privacy regulator or human rights advice where appropriate.

Not every internal view is a reportable privacy breach. The response depends on the employer, applicable law, information, audience, purpose and harm. Obtain advice before making definitive legal allegations.

Can the Employer Verify the Certificate?

Limited verification is different from broad sharing. An employer may confirm authenticity with the issuing clinic, but the clinic should not disclose diagnosis or clinical notes without appropriate authority.

The Fair Work evidence page says it generally does not consider it reasonable for an employer to contact the employee's doctor for further information. Read how certificate verification works.

More of Our Services

Using Dociva

Dociva's current online options cover sick-leave, carer's leave, study and multi-day medical certificate requests. An Australian registered medical practitioner independently assesses each request before deciding whether a certificate and any supported period are appropriate.

Certificates are not guaranteed and Dociva does not provide backdated medical certificates. Patients should submit documents through the employer's designated confidential channel and retain the original. Dociva cannot determine an employer's legal privacy obligations.

For a genuine current need in one of those categories, review the Dociva medical certificate application. Use Fair Work, a union, the relevant privacy regulator or a qualified lawyer for workplace disclosure disputes.

Frequently Asked Questions (FAQs)