← Back to articles

FMLA Medical Records Requirements: What You Must Provide

What medical records FMLA requires, what you can keep private, key deadlines, and how employers must protect your paperwork. Plus how to organize it all.

FMLA Medical Records Requirements: What You Must Provide

FMLA Medical Records Requirements: What You Must Provide

Clinician completing an FMLA certification form

You need a medical certification, not your full medical records. For leave tied to your own serious health condition or a family member’s, your employer may ask for a certification from a health care provider. You have at least 15 calendar days to return it. Your employer cannot demand your complete chart. Here is what the rules require, what stays private, and how to keep your paperwork under control.

Medfiles
medfiles.ai
Keep FMLA Paperwork Organized
Store certifications and other medical documents securely in one place, so you can access your records when paperwork needs attention.
Visit MedFiles

TL;DR

  • Certification, not full records. Employers may require a provider’s certification with enough medical facts to show a serious health condition. They can’t require your whole medical file.
  • 15 calendar days. That is the minimum time you get to return the certification after the request.
  • No diagnosis required. You don’t have to share your diagnosis with your employer, and you don’t have to sign a general medical release.
  • Confidential and separate. Employers must keep FMLA medical records apart from regular personnel files.
  • Keep your own copy. A organized digital record makes every deadline, resubmission and renewal easier.

Table of Contents

Do you need medical documentation for FMLA?

It depends on why you are taking leave.

For leave due to your own serious health condition, or to care for a family member with one, your employer may require a certification from a health care provider. That is the standard step.

For leave to bond with a newborn, or a child placed with you for adoption or foster care, the same Department of Labor (DOL) page says you cannot be required to provide a certification. Your employer may still ask for simple proof of the family relationship in some cases, so read your employer’s notice carefully.

When you first ask for leave, you don’t need to give details. The DOL says you only need to tell your employer enough for them to know the leave may be protected by the FMLA. You don’t have to name the diagnosis at that stage.

Do you need medical documentation for FMLA?

What the medical certification must contain

The certification is a limited document. Under 29 CFR 825.306, your employer may require it to include:

  • The provider’s name, address, telephone and fax numbers, and type of medical practice or specialty
  • The approximate date the serious health condition began and its probable duration
  • A statement or description of appropriate medical facts sufficient to support the need for leave

That regulation also says no information may be required beyond what the rules specify. The DOL offers two optional forms, WH-380E for your own condition and WH-380F for a family member’s. Employers can use them or create their own, as long as they ask for nothing extra.

Two more points from the DOL’s Fact Sheet #28G:

  • The certification should not contain information about genetic tests, genetic services, or evidence of disease among family members.
  • Your provider may include a diagnosis, but is not required to.

If you are asking a doctor to fill out the form, share these two points. Many providers include more detail than the employer needs.

FMLA certification deadlines at a glance

Timing is where most people get tripped up. Here is the sequence.

Step Timing Source
Employer requests certification At the time you give notice, or within five business days after. For unforeseen leave, within five business days after leave starts 29 CFR 825.305(b)
You return the certification Within 15 calendar days after the request 29 CFR 825.305(b)
You fix an incomplete or insufficient certification Seven calendar days after the employer’s written notice DOL elaws Advisor

The DOL also notes that in some circumstances you may be entitled to more than 15 days. If your provider’s office is slow, tell your employer early and in writing.

What happens if you miss the deadline? Per Fact Sheet #28G, your employer can deny FMLA protection for the leave after the 15 days end, until you provide a complete and sufficient certification. Don’t let a fax get lost. Send it in a way that leaves a record.

What you don’t have to hand over

This is the part many employees don’t know.

So if a form or HR email asks for lab results, imaging reports or a broad authorization, pause. Ask what specific item on the certification they say is missing. Then answer only that.

If your certification is incomplete or questioned

A certification can be sent back. Knowing the vocabulary helps.

  • Incomplete means one or more entries are blank.
  • Insufficient means the information is vague, ambiguous, or non-responsive.

Both definitions come from 29 CFR 825.305©. Your employer must tell you in writing what additional information is necessary, and give you seven calendar days to cure the deficiency, unless that is not practicable despite your diligent, good faith efforts. If the problem isn’t fixed in the resubmission, your employer may deny the leave.

Contact between your employer and your provider

Once you submit a complete and sufficient certification, your employer may not request additional information from your provider. The employer may contact the provider only to clarify or authenticate, and only after giving you a chance to fix any deficiencies.

Authentication has a narrow meaning. It means sending the provider a copy of the certification and asking whether the provider completed or authorized it. No additional medical information may be requested, and your permission is not required for that step.

Second and third opinions

If your employer doubts the certification, it may ask for a second opinion. If the first and second opinions differ, the employer may require a third opinion at its own expense. According to the DOL, the third opinion is final and binding, and the provider must be designated or approved jointly by you and your employer.

Who can see your FMLA medical records

Your employer must treat what you submit as confidential. Under 29 CFR 825.500(g), certifications, recertifications and medical histories must be kept as confidential medical records, separate from usual personnel files. Where they apply, ADA confidentiality rules cover them, and GINA rules cover family medical history or genetic information.

The same regulation lists the limited exceptions:

  • Supervisors and managers may be told about necessary work restrictions and accommodations.
  • First aid and safety personnel may be told if your condition might require emergency treatment.
  • Government officials investigating FMLA compliance get relevant information on request.

A supervisor does not get your certification. They get what they need to schedule work.

Does HIPAA apply?

This is a common point of confusion. HIPAA governs health care providers, health plans and other covered entities. It generally does not govern an employer in its role as your employer. One analysis explains that FMLA forms held for leave decisions are generally not PHI under HIPAA, though they stay confidential under FMLA, the ADA and company policy.

The handoff is different. When your provider shares your information with your employer, the HIPAA Privacy Rule must be satisfied. In practice, your provider may need your written permission before sending the form. A clear HIPAA authorization to disclose records names what can be shared, with whom, and for how long. Keep it narrow: the certification only.

Rules for securely sharing an FMLA certification

If your provider’s office offers to text or message the form, ask for a secure channel. A HIPAA texting policy is about more than consent, so a secure portal or encrypted upload is the safer route for anything with medical content.

How long employers keep FMLA records

Under 29 CFR 825.500(b), covered employers must keep FMLA records for no less than three years. They must make them available to DOL representatives for inspection, copying and transcription on request. The DOL elaws Advisor says the same.

That is the employer’s duty. Your duty is simpler: keep your own file. If a dispute comes up in year two, you want your copy of the certification, the date you sent it, and any written notices from HR.

Our perspective

Most FMLA stress isn’t about the law. It’s about paperwork. A form sits in a provider’s inbox. A fax disappears. HR asks for the same page twice. You have days, not weeks, and the records are scattered.

We built MedFiles.ai around a simple belief: your health information should be organized, secure and in your control. When you can find a test result, a provider letter or a signed form in seconds, you respond to your employer faster and share only what is needed.

That matters even more for families. Caring for a parent or a child often means handling records for more than one person. Multi-profile management keeps each person’s documents separate, so the right paperwork goes to the right request.

The principle behind FMLA is a good one: share the minimum, protect the rest. We designed our sharing tools with that principle in mind, so you decide what leaves your account and who sees it.

Team

How to organize your FMLA paperwork

A simple system prevents missed deadlines. Try this.

  1. Create one folder per leave. Put everything for this leave in one place, labeled with the person and the date range.
  2. Save the employer’s request. Keep the notice, the date it arrived, and the deadline you calculated (15 calendar days from the request).
  3. Store the blank form. Keep the WH-380E or WH-380F, or your employer’s own form, before anyone fills it in.
  4. Hand your provider a short note. Ask them to include only the facts the form requires, and to skip genetic or family disease information.
  5. Save the completed certification. Keep a copy exactly as you submitted it, plus proof of when and how you sent it.
  6. Log every contact. Note each call and email with HR, with date and name.
  7. Calendar recertification. Put reminders in for the follow-ups your employer’s notice describes.
  8. Store only what is needed in the leave folder. Keep your wider records, such as lab results and imaging, in your own secure account, not in the file you send.

If you already have records scattered across portals and PDFs, our guide on how to combine medical records walks you through it. For storing and requesting documents from providers, see how U.S. patients can upload and secure records. If you are handling a relative’s leave, set up caregiver access so the right person can retrieve documents when you can’t.

For longer-term habits, read about maintaining long-term medical records safely. When you need to pass a document to a provider or family member, secure sharing tips for families cover the basics.

Keep every FMLA document in one secure place

MedFiles.ai is a HIPAA-ready platform where you store, organize and access your medical records digitally. Upload test results, reports, prescriptions and provider letters. They are organized automatically. Share securely with providers or family members. Manage separate profiles for each family member, including pets.

The Start free plan needs no credit card. Paid plans are Understand Your Health at $2.99 per month and Protect Everyone at $4.99 per month. See plans and pricing to pick the right fit.

Medfiles

Want to see how it protects your data? Read about our security and privacy approach, or learn how family medical records work in one place. Create your free account and keep your next form where you can find it.

FAQ

Do I need medical documentation for FMLA?

Usually yes, for your own serious health condition or to care for a family member with one. Your employer may require a provider’s certification. For bonding with a new child, a certification cannot be required, according to the Department of Labor. You only need to provide the certification, not your full records.

How long do I have to return the FMLA medical certification?

At least 15 calendar days after your employer’s request, per 29 CFR 825.305. If your employer says it is incomplete, you get seven calendar days to fix it. Ask for more time in writing if your provider is delayed.

Can my employer see my diagnosis or full medical file?

No, not as a requirement. The certification needs medical facts sufficient to support the leave, and a diagnosis is optional for your provider, per the DOL’s Fact Sheet #28G. You are not required to sign a general medical release.

Where must my employer keep FMLA medical records?

In confidential files separate from your regular personnel file, as 29 CFR 825.500 requires. Access is limited. Supervisors may learn only about work restrictions and accommodations.

How long are FMLA records kept?

Employers must keep FMLA records for at least three years and make them available to the DOL on request. Keep your own copies for at least as long.

Sources