Privacy and preparation
Health details in HR and leave records: what to exclude before licensing
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Before licensing company records, exclude employee medical information wholesale: leave and FMLA files, accommodation requests, benefits claims, workers' compensation records and return-to-work notes stay out entirely. The harder task is finding health details that leak into manager emails, scheduling notes, chat threads and timesheet codes, where targeted search and redaction keep the operational record usable.
Key takeaways
- Medical, leave and accommodation records are excluded as whole record families, not redacted.
- Health details leak into ordinary work records through manager emails, scheduling notes, chat and timesheet codes.
- When a health detail appears in an operational record, keep the operational fact and remove the reason.
- Threads that center on an employee's health are dropped, even when they sit in a work channel.
- HR mailboxes, HR channels and HR staff's direct messages are usually excluded at the source.
Why are medical and leave records excluded wholesale?#
Medical and leave records are excluded wholesale because confidentiality is their defining feature, and redaction cannot make them safe to license. Employers are generally expected to keep employee medical information confidential and apart from ordinary personnel files, an expectation tied to the ADA and FMLA, and many states add rules of their own.
Health information is also treated as sensitive personal information under several state privacy laws. California's exemptions for employee and B2B data expired on January 1, 2023, so the CCPA may now reach employee and applicant records held by covered businesses. A leave file with the name removed still describes a diagnosis, a treatment schedule and a return date. It carries little workflow value for an AI developer and real risk for the employer, so the decision rule is simple: the record family stays out.
This is general information. Which laws apply to a particular company's records is assessed with counsel, deal by deal.
HR record families to leave out entirely#
Exclusion should happen at the source, by system, folder, mailbox or channel, rather than by searching for keywords after a broad export. A keyword search can miss parts of a leave file; a folder-level exclusion cannot.
Manufacturers and contractors should check old archives with particular care. OSHA's standard on access to employee exposure and medical records, 29 CFR 1910.1020, requires medical records of employees exposed to toxic substances or harmful physical agents to be preserved for at least the duration of employment plus 30 years, unless a specific standard sets another period. Those records often survive system migrations and sit in legacy file shares that a broad export would sweep up.
| Record family | Where it usually lives | Treatment |
|---|---|---|
| Leave requests and medical certifications | HRIS leave module, HR shared drive, HR mailbox | Exclude the whole family |
| Accommodation requests and interactive process notes | HR case files, legal folders, manager emails | Exclude the whole family |
| Benefits enrollment and claims correspondence | Benefits portal, broker emails, payroll provider | Exclude the whole family |
| Workers' compensation claims and injury reports | Safety system, insurer correspondence, HR files | Exclude medical detail; counsel decides on any safety facts |
| Drug and alcohol test results | Testing vendor portals, HR files | Exclude the whole family |
| Return-to-work notes and fitness-for-duty forms | HR files, supervisor emails | Exclude the whole family |
| Occupational exposure and medical surveillance records | EHS or safety system, occupational health vendor, plant HR files | Exclude the whole family; these persist because OSHA requires long retention |
| Employee assistance program referrals | HR mailbox, benefits vendor | Exclude the whole family |
Where health details leak into everyday work records#
Health details leak into everyday work records whenever someone explains an absence, a schedule change or a work restriction. The reason gets written down next to the operational fact, in systems that are otherwise in scope.
Records like these are valuable for their operational content: who covered, how the schedule changed, how the project recovered. The goal is to keep that content and remove the health detail.
Health details are not only about the employee. Leave to care for a spouse, child or parent brings a family member's condition into the same emails and calendars, and those relatives never had any relationship with the company. Family medical history may also count as genetic information under federal employment law, which carries its own confidentiality expectations. Treat family health details exactly like the employee's own.
- Manager emails: out for surgery next week, covering while she is on maternity leave.
- Scheduling and dispatch notes: light duty only, no ladders until cleared.
- Project staffing notes in Deltek or BQE: on medical leave, back after treatment.
- Chat channels: get-well messages and updates on a colleague's hospital stay.
- Timesheets and payroll exports: leave codes that name FMLA, disability or sick time.
- Performance reviews and one-on-one notes that explain results with a health condition.
- Customer-facing tickets: technician out sick, rescheduling your appointment.
How do you find health details before an export?#
Health details are found by combining source exclusions with targeted term searches and a human read of every hit. Remove the obvious containers first, then search what remains.
Term lists produce false positives, such as a ticket about a hospital client's chiller or a customer's dental office, so reviewers decide each hit. Record the term list and the decisions so the review can be repeated on the next export.
| Signal | Example terms or fields | Where to look |
|---|---|---|
| Leave language | leave, FMLA, maternity, paternity, sick, out until | Email, chat, staffing notes |
| Medical language | surgery, doctor, diagnosis, therapy, treatment, hospital, prescription | Email, chat, tickets |
| Work restrictions | light duty, restrictions, cleared to return, fitness for duty | Dispatch notes, safety logs |
| Disability and accommodation | accommodation, disability, ADA, ergonomic request | Manager email, HR threads |
| Leave codes | Leave type and reason columns | Payroll and time exports |
| HR participants | HR mailbox addresses and HR staff as senders or recipients | Email and chat metadata |
Redact, replace or drop: deciding hit by hit#
Each hit gets one of three treatments, chosen by what the record is about. If the record is about the work and mentions health in passing, redact the detail and keep the fact. If one sentence carries both, replace it with a neutral statement. If the record is about the person's health, drop it.
Replacing with a neutral statement keeps the scheduling logic intact, which is the part an AI developer can learn from. It also avoids a common mistake: redacting the word surgery while leaving the dates, the employee's name and the hospital right beside it.
Check attachments separately from message text. Doctor's notes, scanned leave forms and photos of prescriptions often arrive as PDF or image attachments that a text search never reads, so exclude attachments from HR-adjacent threads or route them through a reviewer before anything leaves the building.
- Redact: technician unavailable, reason removed, job moved to Thursday.
- Replace: on medical leave through the spring becomes unavailable for this period.
- Drop: a thread discussing a colleague's diagnosis, even in a project channel.
- Drop: any message sent to or from the HR mailbox.
Illustrative: an engineering firm reviews project staffing records#
Illustrative: a fictional civil engineering firm is considering licensing project records from Deltek, Outlook and Microsoft Teams: staffing plans, RFIs, submittal reviews and internal design discussions. A first pass shows that project managers often explained staffing changes with health details, and that a resource planning export includes a leave reason column.
The general counsel excludes the HR mailbox, HR channels and HR staff's direct messages at the source and drops the leave reason column. Reviewers search the remaining email and chat with an agreed term list, replace staffing explanations with neutral statements and drop get-well threads. The staffing plans and design reviews stay in scope, and every decision is written into the firm's exclusion log.
How SourceX approaches health details in HR records#
SourceX treats employee medical and leave records as an exclusion, set during the Rights and Preparation steps of the SourceX five-step transaction. The supplier confirms which systems, mailboxes and channels are out of scope before any export, and nothing is shared during the initial fit check.
The exclusion list, the search terms and the treatment decisions are documented in the privacy record of the SourceX Evidence Packet. The supplier approves the prepared records before release, so details that slipped through can be caught by the people who know the context.
Frequently asked questions
Can aggregated leave or absence statistics be licensed?
Aggregates such as absence rates by team carry less risk than individual records, but small teams can make individuals identifiable, and the value to AI developers is usually low. Most companies leave HR data out entirely and focus on operational records. If aggregates are considered, counsel should review group sizes and the purpose first.
Do the same rules apply to contractors and temporary staff?
Treat their health details the same way. Contractors and agency staff explain absences and restrictions in the same emails and chats, and some state laws reach contractor data. How a person was engaged does not change the decision: health details in work records are removed, and health-centered records are dropped.
What about health details customers share in tickets?
Customers sometimes mention their own health, such as a homeowner explaining why a repair is urgent. Those details are also sensitive and are removed during preparation. The same rule applies: keep the operational fact, such as urgency or access needs, and remove the medical reason.
Can an employee consent to having their records included?
Employee consent is often viewed cautiously because of the imbalance between employer and employee, and consent to include medical details in a licensed dataset would be unusual. Exclusion is the simpler and more defensible approach. Counsel can advise whether any consent-based approach is appropriate for a specific record.
Are wellness program records part of HR data?
Yes. Wellness program enrollments, screenings, coaching notes and vendor reports often contain health information and sit outside the main HRIS. Add the wellness vendor's portal, its email notifications and any related shared folders to the exclusion list, and check whether program summaries were forwarded to managers.
Sources
- The California legislature did not extend the CCPA employee and business-to-business exemptions, so they expired on January 1, 2023. Source
- 29 CFR 1910.1020 requires medical records of employees exposed to toxic substances or harmful physical agents to be preserved for at least the duration of employment plus 30 years, unless a specific OSHA standard provides a different period. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.