Generally, an employer can disclose private information only if the disclosure is required by law or if there is a legitimate business need. Take, for example, an employer who has information about the dangerous mental state of one if its employees.