Physical Exam Consent Template

In plain language: Names the examinee, the employer or requesting organization, and the examining medical provider so there is no ambiguity about who authorized what and who will perform the examination.

Common mistake: Listing only the employer's name and omitting the name of the specific examining clinic or physician. If the exam is later challenged, there is no clear record of who was authorized to perform it.

In plain language: States why the exam is being conducted — pre-employment screening, periodic fitness review, post-injury return-to-work — and lists the specific tests or assessments authorized.

Common mistake: Using a catch-all phrase like 'all necessary tests.' Courts have held that blanket authorizations do not constitute informed consent — specific procedures must be listed.

In plain language: The examinee's explicit, voluntary agreement for the named provider to conduct the examination as described.

Common mistake: Omitting language confirming the consent is voluntary. Without it, an examinee who later claims coercion has a stronger argument that the consent was not freely given.

In plain language: Authorizes the examining provider to share the results with named recipients — typically the employer or an occupational health manager — and limits disclosure to those named parties only.

Common mistake: Authorizing disclosure to 'the employer' without naming a specific contact or role. Overly broad disclosure authorization may violate HIPAA and equivalent privacy statutes.

In plain language: Commits both the examining provider and the authorized recipient to keeping examination results confidential, using them only for the stated purpose, and not disclosing them to unauthorized parties.

Common mistake: Storing physical exam results in the employee's general HR file. In the US, the ADA requires medical records to be kept in a separate, secure file with strictly limited access.

In plain language: Specifies how long the examining provider and authorized recipient may retain the results, and how records must be destroyed or anonymized after that period.

Common mistake: No retention period at all, leaving records stored indefinitely. Indefinite retention creates unnecessary privacy liability and may violate sector-specific regulations such as HIPAA or GDPR.

In plain language: Informs the examinee that they may withdraw consent before or during the examination without legal penalty, while acknowledging any employment-related consequences are governed separately.

Common mistake: Failing to include withdrawal language at all. Omitting it leaves the form open to challenge on the grounds that the examinee was not informed of their right to refuse.

In plain language: The examinee confirms they have read and understood the form, signed without coercion, and had the opportunity to ask questions.

Common mistake: No age acknowledgment for a general-purpose form. If the form is used for student athletes or minor participants without a parent-signature block, the consent may be unenforceable.

In plain language: Names the jurisdiction whose laws govern the interpretation and enforcement of the consent form.

Common mistake: Using the employer's home jurisdiction when the examination takes place in a different state or country. Local health privacy laws — not just the employer's home jurisdiction — typically govern.

In plain language: Captures the examinee's dated signature, and — for minors — the parent or guardian's signature and relationship.

Common mistake: Collecting only a printed name without a wet or electronic signature. A printed name alone does not meet the signature requirement in most jurisdictions for a legally binding consent.

A physical exam consent form is a legal document in which an individual voluntarily authorizes a qualified medical professional to perform a physical examination on behalf of a third party — typically an employer or institution. It defines the scope of the exam, names who may receive the results, and records the examinee's informed, dated agreement before any examination takes place. Without a signed consent form, the examination may lack legal authorization and any employment decision based on the results may be challengeable.

No single law universally mandates a standalone consent form for physical examinations, but multiple overlapping statutes make one a practical necessity. In the US, the ADA prohibits employers from requiring medical examinations without a job-related justification and mandates strict confidentiality of results. HIPAA governs how health information is shared and stored. In Canada, provincial human rights codes and PIPEDA impose similar obligations. In the UK and EU, GDPR classifies health data as a special category requiring explicit written consent before processing.

In the US, the ADA permits employers to require physical examinations only after a conditional job offer has been extended — not before. The exam must be job-related and consistent with business necessity. Existing employees may be required to undergo fitness-for-duty exams when there is a legitimate, documented reason to question their ability to perform essential job functions safely. Blanket periodic physicals for all employees in non-safety-sensitive roles are generally not permissible under the ADA.

In most jurisdictions, an employer is entitled to receive only a fitness determination — whether the individual is able to perform the essential functions of the job, with or without reasonable accommodation. The underlying medical details, diagnosis, or test results generally may not be disclosed to the employer. Only designated occupational health staff should have access to full examination records. Sharing more than a binary fitness determination with a hiring manager typically violates the ADA, HIPAA, or their international equivalents.

An individual always has the right to refuse consent. However, for positions where a physical exam is a lawful, job-related requirement — such as safety-sensitive roles — refusal may result in withdrawal of a conditional job offer or other employment consequences, depending on applicable law and the terms of the offer. The consent form should always include a withdrawal clause, and any employment consequences of refusal should be addressed in the offer letter or employment policy, not in the consent form itself.

Retention periods vary by jurisdiction and sector. In the US, OSHA requires some occupational health exposure records to be kept for 30 years. General employment-related medical records are often subject to a 3–7 year minimum depending on the state. In the EU, GDPR requires personal data to be kept no longer than necessary for the stated purpose. Best practice is to identify the longest applicable statutory minimum for your sector and jurisdiction and use that as your baseline, keeping records in a secure, access-restricted file separate from general HR records.

Not automatically. Drug and alcohol testing typically requires a separate authorization form because it involves different privacy considerations, chain-of-custody documentation, and regulatory frameworks — particularly in safety-regulated industries such as transportation, aviation, and construction. If both a physical exam and drug test are required, use separate consent forms for each procedure or include an explicit, clearly labelled drug-testing authorization section within the physical exam consent form.

When the examinee is under the age of legal majority — typically 18 in most jurisdictions — a parent or legal guardian must provide consent on the minor's behalf. Some jurisdictions permit minors to consent to specific types of examinations (such as reproductive health screenings) at a lower age threshold. The consent form should include a dedicated parent or guardian signature block, a relationship field, and a statement confirming the signer's legal authority to consent on the minor's behalf.

In most jurisdictions, yes. In the US, the ESIGN Act and UETA recognize electronic signatures as legally equivalent to wet signatures for most documents, including medical consent forms. The UK and EU have parallel electronic signature frameworks. To ensure enforceability, use an eSign platform that captures a timestamp, signer identity verification, and an audit trail. Consent collected through a simple email reply or checkbox without identity verification is generally considered insufficient for a legally binding medical consent.