The Compliance Side of Pre-Employment Medicals

Pre-employment medicals feel like a straightforward part of the hiring process. Candidate comes in, gets assessed, you get a report. Simple.

Except it isn’t and for many HR and Talent teams in Australia, the gap between what they think is compliant and what actually is compliant is significant.

The risk isn’t just legal exposure, although that’s real. It’s that the way most organisations run pre-employment assessments is disconnected from the governance frameworks that are supposed to protect both the business and the candidate.

This is the conversation we keep having with HR and Talent leaders. And it sits at the heart of a broader problem: workforce health data being managed reactively, in silos, without the visibility or structure to actually govern it.

The legal framework most HR teams underestimate

Pre-employment medicals in Australia are governed by four key pieces of legislation:

• Fair Work Act 2009
• Disability Discrimination Act 1992
• Privacy Act 1988
• Australian Human Rights Commission Act 1986

Taken together, these laws establish one governing principle that every HR and Talent professional needs to know:

The problem is that most organisations aren’t applying this test consistently. They’re running standardised medical assessments across all roles, collecting health data that has no bearing on job function, and in doing so, creating legal exposure they don’t even know exists. 

What you can — and cannot — ask 

The line between compliant and non-compliant assessment is often a question of framing. Here’s how it plays out in practice. 

What is allowed 

Capacity to perform the role. 
Questions framed around function — “Do you have any condition that would prevent you from performing the inherent requirements of this role?” — are generally safe. They’re outcome-focused, not diagnosis-focused. 

Safety-critical assessments in high-risk industries. For roles in mining, construction, transport and utilities, a broader range of testing is appropriate — vision and hearing, drug and alcohol screening, cardiovascular fitness. 
The key word is appropriate: each test must be role-specific and defensible if challenged. 

Targeted injury history. You can ask whether a candidate has current or previous injuries that may impact their ability to perform the role. 
You cannot ask for a full medical history with no job relevance attached. 

Vaccination status where there is a genuine occupational requirement e.g healthcare, aged care, and remote site work being the most common examples. 

What is not allowed 

The list of unlawful questions is longer than most HR teams realise. These are common across industries and almost always create legal exposure: 

• “Do you have any illnesses?” This is too broad & has no link to a specific job  

• “What is your full medical history?” Can be seen as excessive data collection 

• “How many sick days did you take last year?” This can be an indirect discrimination risk 

• “Have you ever made a workers compensation claim?” Can be used to screen out candidates and is legally indefensible 

• “Are you on any long-term medications?” An over-collection of sensitive data 

• “Have you ever experienced anxiety or depression?” This is disability discrimination risk unless directly and demonstrably relevant 

• “Are you planning to have children?” Direct discrimination, always unlawful

The reframe 

The single most important shift HR and Talent teams can make is moving from condition-based questions to capacity-based questions. 

❌ Instead of: “Do you have a back injury?” 

✅ Ask: “Are you able to safely lift 20kg repeatedly as required in this role?” 

❌ Instead of: “Do you have any mental health issues?” 

✅ Ask: “Are you able to maintain concentration and decision-making in a high-pressure environment?” 

❌ Instead of: “Do you have sleep apnea?” 

✅ Ask: “Are there any health factors that may affect your ability to safely perform shift work or extended driving?” 

Where organisations commonly get into trouble 

There are four compliance gaps we see repeatedly across HR and Talent functions. 

Standardised medicals applied across all roles. The same assessment for a warehouse worker and an office-based worker is almost always a legal risk. The inherent requirements are different; the assessment must reflect that. 

Over-collection of health data. The Privacy Act 1988 requires that sensitive health information collected is the minimum necessary for a legitimate purpose. Collecting more than that; Even if it is consensual, is a breach. 

Excluding candidates without assessing reasonable adjustments. If a candidate doesn’t meet a medical threshold, the legal obligation is to assess whether reasonable adjustments would allow them to perform the role safely. Automatic exclusion without that assessment is unlawful. 

Poor documentation. If you can’t demonstrate why each component of an assessment is required and how it links to the inherent requirements of the role, you don’t have a defensible position.  

Why this is a data governance problem, not just an HR problem 

Here’s what connects pre-employment compliance to the broader workforce health challenge: the information collected during a pre-employment medical doesn’t exist in isolation. It needs to flow through to HR, to safety, to operations, and it needs to be governed properly at every step. 

In most organisations, it doesn’t. Pre-employment results sit in a provider portal. Recalls get managed in a spreadsheet. Nobody has a single view of what was collected, why, and what it means for the ongoing management of that worker’s fitness for work. 

This is where legal compliance and operational risk converge. A non-compliant assessment creates immediate legal exposure. But a compliant assessment that isn’t properly stored, tracked and governed creates a different kind of risk. One that compounds over time, across the workforce, until something goes wrong. 

The organisations getting this right aren’t just asking better questions at the point of hire. They’re connecting pre-employment data to ongoing surveillance, managing it in a system that creates an auditable trail, and giving the right people visibility at the right time. That’s the difference between compliance and governance. 

The practical test 

Before your next pre-employment assessment is designed or reviewed, apply this test to every question and every component: 

• Is this directly linked to an inherent requirement of the role? 

• Is this the least intrusive way to assess it? 

• If challenged by the Australian Human Rights Commission, could we clearly justify its inclusion? 

If the answer to any of those is no, remove it or reframe it around capacity. The goal isn’t to reduce rigor. It’s to ensure the rigor you do apply is defensible, role-specific, and connected to a broader framework for managing workforce health risk.