There is no law against this. However, it may well be against company policy. If not, then while unprofessional, it is legal. The fact is that there is less of an "expectation of privacy" in the workplace.Note If in the review certain medical information was for some reason revealed, then such a disclosure may have constituted a violation of HIPPA.