Disclosure, privacy and medical information: getting both right

Last verified: 2026-07-29

You can require safety-relevant disclosure. You cannot run a fishing expedition through an employee’s medical life. The policies that survive scrutiny do both deliberately.

What you can require

• Disclosure of any medication — prescribed or otherwise — that may affect the employee’s ability to perform their duties safely, particularly in safety-relevant roles.
• Enough information to run a fitness-for-work assessment: the fact of the medication, whether it contains THC, and its relevance to the role — typically via a medical certificate or prescriber letter addressing fitness for specific duties.
• Participation in lawful, reasonable testing under the policy.

What you can’t

• Demand a full medical history, the underlying diagnosis beyond what safety requires, or direct contact with the treating practitioner without the worker’s written consent.
• Collect health information without explaining why, or hold it insecurely. Prescription details are sensitive health information under privacy law — collect the minimum, restrict access to those who need it, and never let it circulate as workplace gossip via the disciplinary process.
• Treat the disclosure itself as misconduct. Punishing disclosure guarantees your workforce stops disclosing — and concealment is the fact pattern behind every case in our tracker.

Design the disclosure channel like you want it used

Name a role (not a person) to receive disclosures. Put it in writing with a simple form — the Policy Pack’s disclosure form collects exactly the safety-relevant fields and nothing else. Explain in the policy what happens next (assessment, not automatic discipline), how the information is stored, and who sees it. Workers disclose into processes they trust; every case where a worker hid a prescription is partly a story about a channel they didn’t.