Does HIPAA apply to job interviews and employment records?
On this page
- Who and what does HIPAA cover?
- Which hiring records are PHI, and which are not?
- When does HIPAA still apply to hiring?
- Which laws protect health information in hiring records?
- Do you need a business associate agreement for interview tools?
- Practical rules for healthcare recruiters
- Questions people ask
HIPAA usually does not apply to job interviews or hiring records. The HIPAA Privacy Rule binds only covered entities (health plans, health care clearinghouses and health care providers that conduct standard transactions such as billing electronically) and their business associates, and its definition of protected health information expressly excludes "employment records held by a covered entity in its role as employer." So a hospital recruiter's interview notes, recordings and scorecards are employment records, even if a candidate mentions a health condition. That information is protected by other laws instead: the ADA's confidentiality rules, GINA, state medical privacy laws and, for EU and UK candidates, the GDPR. HIPAA does still matter when a candidate is also a patient, when a covered clinic performs a pre-employment exam, and when clinician candidates describe real patients. This is the position as of October 2026.
For which AI note takers offer a business associate agreement, see our guide to AI note takers for healthcare staffing; for what you may ask about health before and after an offer, see pre-employment medical exams under the ADA.
This is not legal advice. It summarizes the HIPAA regulations at 45 CFR parts 160 and 164, HHS guidance, the ADA, GINA and one state statute as of October 2026. Whether your organization or a vendor is a covered entity or business associate depends on facts; confirm with your privacy officer or counsel.
Who and what does HIPAA cover?
The HIPAA rules apply to three kinds of covered entity: "a health plan," "a health care clearinghouse," and "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter," and, where the rules say so, to business associates (45 CFR 160.102). They protect "protected health information," and the definition carves out four categories, including individually identifiable health information "in employment records held by a covered entity in its role as employer" (45 CFR 160.103).
HHS puts it plainly for individuals: "The Privacy Rule does not protect your employment records, even if the information in those records is health-related. In most cases, the Privacy Rule does not apply to the actions of an employer." And for people who work for a provider or health plan: "The Privacy Rule does not apply to your employment records," though it does protect their records as a patient or plan member (HHS, Employers and Health Information in the Workplace).
Which hiring records are PHI, and which are not?
| Record | HIPAA PHI? | What protects it instead |
|---|---|---|
| Interview notes, recordings, transcripts and scorecards | No: employment records | Employment discrimination law, record retention rules, state privacy law, GDPR for EU and UK candidates |
| A candidate's mention of their own health condition in an interview | No | ADA limits on pre-offer disability questions and on using the information; state law |
| Accommodation requests and post-offer medical exam results held by the employer | No | ADA: separate, confidential medical files (42 U.S.C. 12112(d)(3)(B)) |
| Family medical history or genetic test information | No, when held as employer | GINA confidentiality (29 CFR 1635.9) |
| The candidate's own patient chart at the hospital where they apply | Yes | HIPAA, because the hospital holds it as a provider, not as an employer |
| Exam results held by a covered occupational health provider before release | Yes | HIPAA; disclosure to the employer needs the candidate's authorization |
When does HIPAA still apply to hiring?
The candidate is also a patient
A hospital or clinic wears two hats. Its patient records are PHI; its employment records are not. The exclusion covers records held "in its role as employer," so it does not let hiring staff look up an applicant's chart. Treat patient systems as off limits for recruiting, and make sure anyone with dual access knows that.
A covered provider performs a pre-employment or post-offer exam
When an occupational health clinic that is a covered provider examines a candidate at the employer's request, the results are PHI in the clinic's hands, and HHS notes that a provider asked directly by an employer "cannot give your employer the information without your authorization unless other laws require them to do so." HIPAA allows the clinic to make the exam conditional on that authorization: a covered entity "may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization" (45 CFR 164.508(b)(4)(iii)). Once the employer receives the results, they are employment records under the ADA's confidentiality rules.
Clinician candidates describe real patients
Nurses, therapists and physicians often explain their experience through cases. HIPAA's duties fall on covered entities and their "workforce," defined as "employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity ... is under the direct control of such covered entity" (45 CFR 160.103). A candidate who shares identifiable details from a current job may be breaching their employer's obligations; the interviewer receiving them is not, by that fact, a covered entity. Either way, no one benefits from the details. Ask for de-identified examples ("without names, dates or room numbers, tell me about a rapid response you led") and leave identifiers out of notes.
Which laws protect health information in hiring records?
- The ADA. Before an offer, an employer "shall not conduct a medical examination or make inquiries of a job applicant as to whether such applicant is an individual with a disability" (42 U.S.C. 12112(d)(2)(A)). After an offer, medical information must be "collected and maintained on separate forms and in separate medical files and ... treated as a confidential medical record," shared only with supervisors who need to know about restrictions or accommodations, first aid and safety staff, and government investigators (29 CFR 1630.14(b)(1)).
- GINA. Genetic information, which includes family medical history, must be kept in files "separate from personnel files" and treated as a confidential medical record; it can share a file with ADA medical information (29 CFR 1635.9).
- State law. California's Confidentiality of Medical Information Act requires "each employer who receives medical information" to "establish appropriate procedures to ensure the confidentiality and protection from unauthorized use and disclosure of that information" (Civ. Code 56.20(a)). Other states have their own rules.
- GDPR and UK GDPR. Health data about EU or UK candidates is special category data with its own conditions; see recording interviews under UK GDPR.
Do you need a business associate agreement for interview tools?
A business associate is a person who, "on behalf of" a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function (45 CFR 160.103). Because hiring records are not PHI, a transcription or note-taking tool used only for interviews does not handle PHI on a hospital's behalf for that use, and HIPAA does not on its own require a BAA for it.
Three situations change that answer, and are worth raising with counsel:
- The same tool, under the same account, is also used for clinical or patient-facing conversations.
- Your organization's policy treats any vendor touching staff or patient data as needing a BAA, regardless of the legal minimum.
- Interviews routinely include identifiable patient details, despite coaching.
Separately, a staffing agency recruiting nurses is usually not a covered entity for its recruiting work; one that also provides care, such as a home health agency that bills electronically, may be a covered provider for that side of its business. Keep the two sets of records apart.
Practical rules for healthcare recruiters
- Do not ask about diagnoses, medications or medical history before a conditional offer; ask whether the candidate can perform the job's essential functions, with or without accommodation. Our interview guide for healthcare roles has job-related wording.
- Coach clinicians to give de-identified case examples, and keep names, dates and record numbers out of notes.
- Never look up a candidate in patient systems.
- Route exam results through a signed authorization, then into a separate confidential medical file, not the ATS.
- Handle accommodation requests outside the hiring team where possible; see ADA accommodations in interviews.
- Apply the same retention schedule to interview records as to other hiring records; see how long to keep interview notes.
Questions people ask
Are interview notes protected by HIPAA?
Generally no. HIPAA's definition of protected health information excludes employment records held by a covered entity in its role as employer, and most recruiters and employers are not covered entities for hiring purposes anyway. Health details in interview notes are protected instead by the ADA's confidentiality rules, GINA, state privacy laws and, for candidates in Europe, the GDPR.
Can a hospital use a job applicant's patient records in a hiring decision?
No, not without the person's authorization. If the applicant is also a patient, their medical records remain protected health information held by the hospital as a provider, and the HIPAA Privacy Rule controls how that information is used or disclosed. Hiring staff should never look up a candidate's patient file.
Do I need a HIPAA business associate agreement for an AI note taker used in interviews?
Not for interview content alone, because hiring records are not protected health information. A BAA is required when a vendor creates, receives, maintains or transmits protected health information on behalf of a covered entity, so it becomes relevant if the same tool is used for clinical conversations or if candidates describe identifiable patients. Ask counsel how your organization uses the tool.
Can an occupational health clinic send pre-employment exam results to the employer?
Only with the candidate's written authorization if the clinic is a HIPAA covered provider. HIPAA lets the provider condition an exam done solely to create information for a third party, such as an employer, on the candidate signing that authorization. Once the employer receives the results, they become employment records subject to the ADA's confidentiality rules.