This tests whether you can balance confidentiality with internal customer service. Medical records are among the most sensitive employee data, and unauthorized disclosure violates privacy laws and company policy, even when the requester is a manager.
First, acknowledge the manager's legitimate need to plan work. Then explain the limits of what you can share, offer a compliant alternative such as absence dates or leave balances, and involve your HR supervisor if the manager insists on more.
Start by thanking the manager for coming to you, and acknowledge that planning the team's workload is a real and urgent need, especially in a fast-paced BPO environment where every headcount matters. Then say plainly that you cannot show the medical records, because they are confidential under the Data Privacy Act and company policy, and that even you as HR only access them when there is a clear, work-related justification. Explain that you can share what the manager actually needs to plan around, which is the employee's absence dates, the number of sick leave days used, and whether the medical certificate on file is valid and current. Offer to provide that summary in writing or in person, and suggest a practical next step such as discussing a temporary workload adjustment or backfill arrangement with the employee's own supervisor. If the manager pushes back or says they need the diagnosis to make a decision, stay calm and repeat that the diagnosis is not necessary for planning, and that you would need to loop in your HR supervisor before sharing anything further. Close by reassuring them that you are on their side and want to help solve the scheduling problem within the rules.
A common mistake is saying 'Tingnan lang natin kung may TB ba siya' or casually showing the file to please a superior. Instead, state that only HR personnel with a legitimate need may view medical data, and that you can only share absence dates and validity of certificates.
Situation
In my previous role as an HR assistant at a logistics company, a department head requested to see the medical certificate of one of his staff members who had been absent often, claiming he needed to verify if the absences were legitimate.
Task
I had to deny access to the medical record without undermining the manager's authority, while still addressing his legitimate need to plan the team's workload.
Action
I explained that medical records are confidential under company policy and that I could only confirm the dates of absence and whether they were covered by valid medical certificates, not the specific diagnosis. I offered to work with him on a staffing plan based on the approved leaves and suggested that if he needed more details, he could raise the concern with HR management for a proper review. I documented the request and my response in the HR system.
Result
The manager accepted the alternative information and was able to adjust his team's schedule without seeing any private medical details. The employee's privacy was protected, and no policy was breached.
You can support a manager's operational needs without exposing an employee's private health information.
Write your own answer, then get instant AI feedback graded against:
Get AI feedback on your answer — free.
3 free AI-graded answers + 1 free mock interview, no card needed.
Sign Up FreeAlready have an account? Log in
Sign in to join the conversation.
No answers shared yet — be the first to show how you'd approach this.