29 CFR Part 1630, Regulations to Implement the Equal Employment Provisions of the ADA (Title I Regulations with amendments issued through May 2016)

(iv) Provides employees with a notice that:

(A) Is written so that the employee from whom medical information is being obtained is reasonably likely to understand it;

(B) Describes the type of medical information that will be obtained and the specific purposes for which the medical information will be used; and

(C) Describes the restrictions on the disclosure of the employee's medical information, the employer representatives or other parties with whom the information will be shared, and the methods that the covered entity will use to ensure that medical information is not improperly disclosed (including whether it complies with the measures set forth in the HIPAA regulations codified at 45 CFR parts 160 and 164).