The \"Direct Threat\" Defense and Safety-Based Exclusion From Work

Scope and warning#

This Roadmap addresses disability-related safety defenses under the ADA and FEHA.

It does not address ordinary performance rules unrelated to disability. An employer can enforce legitimate safety standards against all employees without invoking direct-threat doctrine when disability is not the basis of the decision.

It also does not decide whether a clinical standard, licensing rule or facility requirement is valid. Those can interact with disability law but require their own analysis.

The factual situation this roadmap addresses#

Consider a hypothetical clinician with an episodic medical condition. The clinician has performed safely for years and later takes medical leave. A treating professional clears return. The employer nevertheless expresses concern that another episode could occur while the clinician is treating patients and could endanger the clinician or others.

The concern may be sincere. The legal question is whether it satisfies the safety-defense framework.

What is the predicted event? How likely is it? How severe would the harm be? How imminent is it? What is the duration of the risk? What evidence describes the employee's current condition? What does the work history show? What essential duties create exposure? Could schedule changes, monitoring, leave, reassignment, or another accommodation reduce the risk? Did the employer actually analyze those options?

A vague statement that “safety comes first” does not answer those questions.

Federal statutory framework#

42 U.S.C. section 12111(3) defines direct threat as a significant risk to the health or safety of others that cannot be eliminated by reasonable accommodation.

Section 12113(a) permits an employer to defend a disability-screening qualification standard only on a showing that the standard is job-related, consistent with business necessity, and cannot be met through reasonable accommodation. Section 12113(b) expressly permits a no-direct-threat qualification standard addressed to the safety of others. By contrast, 29 C.F.R. sections 1630.2(r) and 1630.15(b)(2) cover substantial harm to the individual or others, and permit reduction of risk through accommodation rather than demanding elimination of every conceivable risk. The threat-to-self regulation was sustained in Echazabal; the statutory and regulatory texts should not be quoted as identical.

These are affirmative, evidence-dependent defenses, not a license to invoke any nonzero occupational risk. In a categorical screening-standard dispute, evaluate section 12113(a) separately from a case-specific section 1630.2(r) direct-threat assessment.

Threat to self after Echazabal

The statutory definition expressly refers to risk to others. The Supreme Court in Chevron U.S.A. Inc. v. Echazabal, 536 U.S. 73 (2002), upheld the EEOC regulation permitting an employer to defend an exclusion designed to protect an employee from a direct threat to the employee's own health.

That decision resolved an important federal question and reversed the earlier Ninth Circuit position that had read the statutory defense more narrowly.

On remand in Echazabal v. Chevron USA, Inc., 336 F.3d 1023 (9th Cir. 2003), the Ninth Circuit reversed summary judgment for Chevron because the record raised genuine disputes about an individualized threat-to-self assessment. In particular, opinions about hepatotoxic exposure had not been tied to the specific chemicals, concentrations, job exposure or likelihood of harm. The Supreme Court's legal approval of the regulation did not establish that Chevron had proved the defense on its facts. Conversely, the remand did not establish that every medically supported exclusion would be unlawful.

California health-and-safety defense#

2 C.C.R. section 11067 separately addresses FEHA.

For risk to the individual with a disability, the employer must demonstrate, after engaging in the interactive process, that there is no reasonable accommodation allowing performance of essential functions without an imminent and substantial degree of risk to the employee.

For risk to others, the regulation similarly requires no reasonable accommodation that would permit performance without an imminent and substantial degree of risk to others.

Subdivision (d) rejects a defense premised solely on a condition or disease carrying a future risk when the condition does not presently interfere with safe job performance. This does not make every prospective harm legally irrelevant: subdivisions (b), (c) and (e) still require an evidence-based assessment of a presently relevant imminent and substantial danger. A hypothetical future possibility cannot simply replace that assessment.

Subdivision (b) was amended effective April 1, 2016. Historical exclusions must be analyzed under the regulation operative at the challenged decision date; this working draft does not assume that the currently reproduced wording controlled before then. The current text was cross-checked in identified reproductions, not authenticated in a live official California regulation database.

California's wording makes the interactive process and the availability of accommodation explicit prerequisites to these safety defenses.

The four core risk factors—and California's work-history factor

Federal direct-threat analysis commonly looks to:

1. duration of risk;
2. nature and severity of potential harm;
3. likelihood that harm will occur; and
4. imminence of potential harm.

California section 11067 includes those factors and also directs consideration of relevant information about the employee's past work history.

These factors prevent a diagnosis from becoming a shortcut. A serious potential harm with extremely remote probability may present a different legal problem from a highly likely near-term event. A lifelong diagnosis with years of safe work can carry different evidentiary significance from a current unstable condition.

No factor should be evaluated in isolation.

Individualized assessment is the center of the doctrine

The assessment concerns the actual person in the actual job at the relevant time.

An employer should not assume that everyone with a particular psychiatric, neurological, cardiac, infectious, mobility or other condition poses the same risk. Nor should a general population statistic automatically decide an individual's risk.

Relevant evidence can include current medical information, work history, observed conduct, essential job functions, treatment response, restrictions, incident history, and proposed accommodation.

The assessment should be current enough to address the decision being made.

Objective evidence rather than subjective fear

In Nunes v. Wal-Mart Stores, Inc., 164 F.3d 1243 (9th Cir. 1999), the employee had recurring fainting episodes; the Ninth Circuit reversed summary judgment after examining qualification, potential additional leave, direct threat and the lack of meaningful consideration of risk-reducing on-the-job accommodations. It rejected reliance on subjective safety fears without substantial information about work and medical history. It also rejected treating an application for state disability benefits as an automatic judicial admission that the employee was unqualified.

Nunes does not prove that every episode of syncope is compatible with every safety-sensitive job. Its evidentiary rule is that an employer must test the risk in the actual position with the actual employee, including available accommodations. Sincere concern does not substitute for that record.

Reasonable accommodation is part of the defense

Direct threat is not established merely by proving risk before accommodation.

The question is whether the significant risk can be eliminated or reduced to an acceptable level through reasonable accommodation without undue hardship.

Possible risk-reducing accommodations can include task modification that preserves essential functions, schedule changes, temporary leave, additional safeguards, protective equipment, modified exposure, reassignment, or other fact-specific measures.

The employer need not eliminate an essential function or accept an accommodation imposing undue hardship. The accommodation must be linked to the job and a plausible reduction in the asserted risk; an employee's suggestion is not proof that it is feasible. In Dark v. Curry County, 451 F.3d 1078 (9th Cir. 2006), the Ninth Circuit recognized that an employee with uncontrolled seizures could lack present ability to operate heavy equipment without accommodation, yet found triable issues involving leave or reassignment and the interactive process. It did not require an employer to excuse an essential duty indefinitely.

An important opposing boundary is Mayo v. PCC Structurals, Inc., 795 F.3d 941 (9th Cir. 2015): on the facts of repeated, serious workplace death threats, the court affirmed that the employee was not qualified because essential job functions included appropriate workplace interaction. The court expressly distinguished mere rudeness or an offhand expression of frustration and relied on essential-function qualification rather than finding a generalized future direct threat. Mayo is not a categorical rule that psychiatric disability, medical leave, or a speculative future episode renders healthcare work unsafe.

Essential functions and safety standards

Some safety rules are themselves tied to essential job functions. A surgeon must perform the actual surgical functions safely; a correctional physician may have identified emergency-response functions; a medication nurse may have defined dose-verification duties; and a vehicle operator may need required credentials. Each asserted function must be documented, including whether site-access conditions are employer rules, county contract terms, professional licensing obligations or federal requirements. These categories are not interchangeable. 29 C.F.R. section 1630.15(e) separately provides a defense where an action is required or necessitated by another federal law or regulation; it does not make any self-selected local rule a federal mandate. EEOC guidance also cautions that a state safety rule allowing a broader disability exclusion does not automatically override ADA protections. These propositions do not establish that any individual medical condition defeats qualification.

The evidence should identify the essential function first and then the actual safety risk attached to it.

Safety standards also should be distinguished from convenient operational preferences.

Patient safety in healthcare

Healthcare settings produce difficult cases because potential harm can be severe. EEOC's Health Care Workers and the Americans with Disabilities Act guidance, question 8, expressly includes patient-safety and self-exposure scenarios, including invasive procedures and exposure to bodily fluids, but still requires individualized analysis when a disability-related concern is used to bar a worker. The guidance is agency interpretation rather than a judicial determination about any named employer or clinician.

Severity is one factor, not an automatic substitute for likelihood, imminence, duration, current medical evidence and accommodation. The employer should connect the proposed risk to specific duties and the available controls in that particular clinical environment; the title “physician” or the label “correctional healthcare” is not itself a medical risk finding.

A clinician's past safe practice can be relevant under California's work-history factor. A recent event can also be relevant. Neither history nor a single incident should be abstracted from current medical and functional evidence.

For public-facing analysis, do not characterize a clinician as unsafe merely because a dispute exists. Safety conclusions require evidence and can carry serious professional consequences.

Infectious disease and exposure risk

Direct-threat doctrine has roots in cases involving infectious disease, and the same principles remain instructive.

The analysis should use current knowledge about transmission, actual exposure pathways, duration, severity, likelihood and precautions rather than fear associated with a diagnosis.

Healthcare infection-control rules or public-health requirements may supply independent standards, but they should be identified specifically.

Mental-health and episodic conditions

An episodic psychiatric or neurological condition can be a covered disability without making the employee currently unsafe.

The ADA expressly recognizes episodic conditions in the disability definition when they substantially limit a major life activity when active. Safety analysis, however, focuses on current direct-threat evidence at the time of the employment decision.

Risk of recurrence can be relevant, but generalized possibility is not the same as significant, imminent risk.

The record should distinguish diagnosis, probability, functional limitations, warning signs, treatment, past incidents and actual job exposure.

Medical disagreement and employer judgment

An employer is not always bound by the employee's treating provider. Nor does an employer-selected physician automatically control.

When opinions conflict, useful questions include:

• each provider's specialty and expertise;
• whether the provider knew the essential functions;
• what records were reviewed;
• how current the examination was;
• whether conclusions were explained;
• whether the opinion measured the legal risk factors;
• consistency with observed work history;
• whether accommodation was considered.

The ultimate employment decision should be traceable to evidence, not title alone.

Risk must be translated into a concrete scenario

Safety analysis becomes more reliable when the predicted harm is described with precision.

“Could have another episode” is not enough by itself. A decision record should identify what an episode would entail, what function would be affected, what harm could follow, how quickly harm could occur, what safeguards exist, and how often the employee is exposed to the relevant situation.

For a clinician, for example, the risk might concern loss of consciousness while performing an invasive procedure, impaired judgment during independent medication decisions, inability to respond during an emergency, or another specific event. Each scenario has a different probability, severity and mitigation analysis.

The more concrete the scenario, the easier it is to test whether the risk is substantial rather than speculative.

Current evidence versus historical episodes

Past medical events can be relevant, but direct-threat doctrine is not a permanent label.

The assessment should ask what the historical event predicts about current risk after treatment, recovery, medication change, accommodation or passage of time. A severe remote event may have limited predictive value if current evidence shows stability. A recent event can have greater weight, especially if the mechanism remains unresolved.

An employer may seek updated medical information only where the distinct inquiry/examination standard is satisfied. Under 42 U.S.C. section 12112(d)(4) and EEOC's 2000 enforcement guidance (questions 5, 12 and 13), an examination of a current employee ordinarily requires a reasonable belief, supported by objective information available before the demand, that a medical condition may impair essential functions or present a direct threat. This preliminary justification is not the same as actually proving direct threat to exclude or terminate the worker. Medical requests should be limited to necessary functional and risk information; when the employer directs an examination by its chosen professional under the EEOC guidance, the employer pays the examination costs. Conflicting occupational and treating-provider opinions require substantive comparison rather than automatic preference for either.

A job-description error, dated observation, uncorroborated rumor, or post-hoc medical rationale should be identified rather than silently imported into the risk record. See Roadmap 017 for the broader medical-inquiry framework.

Probability and severity interact

Direct threat does not reduce to one mathematical threshold.

A high probability of minor harm may not be a significant risk of substantial harm. A very low probability of catastrophic harm requires careful analysis rather than automatic dismissal or automatic exclusion. The duration and imminence factors help frame the issue.

The employer's assessment should show how it weighed these dimensions. Statements such as “any risk is unacceptable” can be problematic where disability law requires a significant-risk analysis.

Accommodation can convert the risk analysis

The same employee can present different risk profiles under different working conditions.

A schedule change may reduce fatigue-related risk. Temporary leave may allow stabilization. A second clinician, modified exposure, equipment, task sequencing, additional monitoring, or reassignment may reduce risk while preserving essential functions.

Not every safeguard is reasonable. The point is that the safety assessment should evaluate available accommodations before concluding that exclusion is necessary.

California section 11067 expressly makes the absence of reasonable accommodation part of the safety defense.

Employer-selected and treating-provider opinions

Conflicting opinions should be compared rather than counted.

A specialist opinion can be strong if it addresses the condition but weak if the specialist does not know the job. An occupational physician may understand workplace demands but have incomplete clinical history. A treating provider may know the condition well but rely on an inaccurate description of essential functions.

A robust assessment supplies accurate job information and asks providers to address the same functional and risk questions. If opinions remain different, the decision record should explain why one is more persuasive.

Safety rules that apply to everyone

Some safety requirements are neutral qualification standards rather than disability-specific reactions.

For example, credentialing rules, infection-control requirements, drug-diversion safeguards, required certifications, or limits on performing procedures while impaired can apply to all clinicians. Their neutral character does not place them outside the ADA or FEHA if they screen out a person because of disability, but it can be important evidence of job-relatedness and business necessity.

The precise rule, source, consistent application and possibility of accommodation all matter. The Ninth Circuit's en banc Bates v. United Parcel Service, Inc., 511 F.3d 974 (9th Cir. 2007), distinguishes a categorical disability-screening safety qualification from a case-specific direct-threat defense. For the screening standard under 42 U.S.C. sections 12112(b)(6) and 12113(a), the employer must demonstrate job-relatedness, business necessity, and inability to accomplish performance through reasonable accommodation. Bates rejected importing a Title VII/age-discrimination BFOQ test into that ADA analysis and vacated/remanded rather than adjudicating the blanket standard lawful or unlawful on the merits. A regulatory standard actually binding on a particular job also differs from voluntarily imposing a standard designed for different positions; verify the rule's scope rather than invoking “DOT,” “licensing,” or “credentialing” generically.

Emergency action versus permanent exclusion

An employer sometimes must act before a complete investigation is possible, particularly after an acute safety event.

A genuinely urgent, objectively documented problem may support an interim safety response while facts are gathered. But “temporary” is not an independent statutory exception to the ADA medical-inquiry and discrimination rules, nor to FEHA's interactive-process framework. Each continued suspension, reassignment refusal or later termination should be analyzed against evidence available at that time, the scope of duties actually restricted, alternatives considered, who authorized the measure, and whether prompt reassessment occurred. A paid suspension can still have legally relevant effects depending on the claim; do not assume that continuation without lost wages ends the inquiry.

Separate the immediate incident and safety triage from the later individualized employment determination. Do not retrospectively justify an unrecorded contemporaneous decision solely with a consultant report written after the exclusion.

What this fact does not prove

A safety-sensitive job does not prove direct threat. A prior episode does not prove current imminent risk. A provider's concern does not prove no accommodation exists. A long safe work history does not prove risk can never change. A serious possible harm does not eliminate the need to assess likelihood. An employer's sincere belief is not a substitute for the required objective evidence.

What would change the analysis?

Key facts include current medical evidence, precise essential functions, frequency and severity of past events, treatment response, work history, the exact predicted harm, likelihood and imminence, accommodation options, external regulatory requirements, and the identity and expertise of the persons performing the risk assessment.

Potentially relevant defendants and decisionmakers#

Safety exclusions often involve HR, occupational health, clinical leadership, supervisors, credentialing personnel and administrators.

The legal employer question remains separate from clinical expertise. A physician leader may advise about patient-safety functions without being the employer. An HR administrator may execute an exclusion without independently deciding medical risk.

Roadmaps 003–005 should be used to identify who supplied the medical judgment, who assessed accommodation, who had worksite authority and who made the final employment decision.

Administrative prerequisites and limitation periods#

An ADA or FEHA safety exclusion can support or defend disability-discrimination, accommodation or related claims. The underlying claim determines the administrative route.

Date the medical inquiry/examination order, initial exclusion, continuing restrictions, accommodation decision, refusal to reinstate and termination separately. An internal appeal, new clearance or later reassessment should not be assumed to restart the limitations period for a previously discrete employment act. ADA claims ordinarily require an EEOC charge (often 180 days, extended to 300 in qualifying jurisdictions); FEHA has a separate CRD process generally measured from the alleged unlawful act and affected by statutory exceptions/tolling. Roadmaps 008, 019 and 034–035 control the current, claim-specific route and calculations, including California changes effective in 2026. No deadline or exhaustion conclusion is made for a particular person from this hypothetical.

A direct-threat worksheet#

A disciplined safety record should make the reasoning reproducible. One useful structure is:

For each row, the internal evidence file should identify assessment date, decisionmaker, exact essential function, factual source, medical knowledge as of that date, specific exposure or clinical circumstance, competing expert interpretation, safeguard considered, and reason for rejecting it. Keep the underlying private medical, patient and employment records in access-controlled evidence; do not reproduce patient identifiers, privileged peer-review materials or an individual's medical details in the public Roadmap. Missing data should be marked not established, not supplied with a narrative guess.

If a diagnosis is said to predict harm, the explanation must connect mechanism, probability, severity, timing and job exposure. If the proposed accommodation is rejected, the decision record should show why it cannot reduce the risk sufficiently while preserving essential duties.

This framework is useful to both sides because it exposes unsupported leaps. It can reveal a genuine risk that was understated by the employee, or a speculative concern that was overstated by the employer.

Burden and evidentiary posture#

The federal direct-threat defense is affirmative; the employer must establish the regulatory risk elements and inadequacy of reasonable accommodation. Echazabal on remand and Nunes demonstrate why generalized or inadequately job-specific opinions may leave triable issues. But the employee separately bears the burden to establish the elements of the particular underlying claim, including qualified status when that element applies. Dark illustrates the difference between current ability without accommodation and plausible ability after leave or reassignment; Mayo demonstrates that an essential-function failure can defeat qualified status without deciding direct threat. A plaintiff cannot win merely because the employer's direct-threat memo is poor if another required claim element fails.

An adversarial test should therefore prepare two separate evidence tables: (1) employee-side coverage, qualification, requested/available accommodations, adverse action and causation; (2) employer-side individualized safety evidence, timing, reasonable medical judgment, four-factor assessment and why specific accommodations fail. The burden cannot be shifted casually between the tables.

Separating direct threat, business necessity and qualification#

These concepts overlap but should not be treated as synonyms.

An employee may be unable to perform an essential function without the case turning on direct threat. A medical examination may be justified by business necessity before the employer knows whether a direct threat exists. A qualification standard can be job-related and consistent with business necessity, while its application to a disabled worker still requires accommodation analysis.

A precise Roadmap labels the doctrine actually being used at each stage rather than using “safety” to cover all three.

What this fact does not prove—and what would change the analysis#

A serious diagnosis does not prove significant risk. The absence of a prior accident does not prove zero future risk. Employer concern does not prove imminence. A medical opinion does not prove the provider understood the job. An accommodation proposal does not prove the risk can be reduced adequately.

The analysis changes with current objective medical evidence, accurate essential functions, quantified or otherwise reasoned likelihood, history of episodes, duration and imminence, expert explanation, work history, and documented testing of risk-reducing accommodations.

Periodic reassessment#

A safety conclusion can become stale. When exclusion lasts for a meaningful period, later medical evidence, treatment response, changed restrictions, a modified job or a proposed accommodation may alter the risk assessment. Neither federal nor California disability law is well served by treating an earlier safety determination as permanently dispositive without considering materially changed facts. The record should identify when reassessment occurred and what new evidence was considered.

Documentation quality

A conclusory notation such as “unsafe” or “high risk” is less informative than a record showing the facts and reasoning behind the conclusion. A strong assessment identifies sources, dates, uncertainties, conflicting information and accommodations considered. That discipline protects employees from stereotype and also helps employers demonstrate that a difficult safety decision was evidence-based rather than improvised after the fact. It also allows a later court or agency to distinguish contemporaneous medical judgment from rationalizations developed only after the employee has already been excluded. The assessment should therefore be dated, attributable, and preserved with the evidence it actually relied upon.

Evidence and records#

Potentially important evidence includes:

• current medical opinions;
• employer-selected examination reports;
• essential-function descriptions;
• incident reports;
• objective observations;
• work history and prior evaluations;
• risk-assessment documents;
• direct-threat worksheets or criteria;
• accommodation options considered;
• communications about safety;
• credentialing or licensing requirements;
• return-to-work forms;
• policies applied to comparable employees;
• meeting or committee records lawfully obtainable;
• decision and appeal records.

Favorable and adverse facts#

Facts that can weaken a safety defense include no individualized assessment, stale medical information, diagnosis-only reasoning, reliance on stereotype, no consideration of accommodation, years of safe work ignored without explanation, or a predicted harm described only as possible.

Facts that can strengthen a safety defense include current objective evidence, serious and likely near-term harm, a direct connection to essential functions, reasoned medical judgment, consideration of work history, good-faith accommodation analysis, and evidence that reasonable accommodation cannot reduce the risk sufficiently.

Likely defenses#

Employers may argue direct threat, business necessity, inability to perform essential functions, undue hardship, independent licensing/credentialing requirements, employee failure to provide necessary information, or lawful enforcement of neutral safety standards.

Employees may challenge whether the evidence was current, objective, individualized, sufficiently probable, tied to essential functions, or tested against accommodation.

The Roadmap does not assume either side is correct.

Causation, damages and remedies#

A safety assessment can cause exclusion from work, but causation still must be traced.

If an independent licensing action already barred practice, an employer may argue the disability-related assessment did not cause the loss. If the employer itself created or mischaracterized the barrier, the analysis differs.

Remedies depend on the underlying ADA or FEHA theory, proof and defenses.

Discovery#

Discovery can test the foundation of the safety decision:

• medical evidence actually relied upon;
• risk criteria;
• policies and training;
• communications with medical reviewers;
• essential-function data;
• work-history evidence;
• accommodation alternatives;
• comparator application;
• timing of decision formation;
• who had authority;
• committee or board records;
• credentialing dependencies;
• communications across related entities.

Medical privacy, peer-review confidentiality, patient protections and privilege may limit what can be obtained, used or disclosed. Preserve chain of custody and the original restricted evidence separately; characterize a private clinical or credentialing record in public only after competent confidentiality/privilege review. A public version must not infer that nonproduction proves the absence of a safety assessment.

CFMG/Wellpath-specific relevance#

Correctional healthcare makes safety and entity attribution particularly sensitive.

A physician may work in a facility where a professional corporation, management organization and county each exercise different forms of authority. The public Roadmap should identify who made the medical-risk assessment, who defined essential clinical functions, who controlled site access, who could modify schedule or duties, and who made the employment decision.

A Wellpath safety concern is not automatically a CFMG board finding. A CFMG formal approval is not automatically proof of independent clinical deliberation. County access requirements are not automatically employer decisions. Each proposition must be supported separately.

No private health or personnel material is used to characterize any specific physician as safe or unsafe.

Primary cases, statutes and regulations#

Tools built after this Roadmap#

Because direct threat is an affirmative defense the employer must prove by an individualized assessment, the employer's assessment file — who assessed, on what medical evidence, considering what duration, nature, severity, likelihood and imminence — is the central discovery target, and Roadmap 038 explains how it is obtained. Roadmap 036 explains how to read the position statement in which the safety rationale is first articulated and how to compare it with the clearance the worker provided. Worksheet 105 records the clearance and the employer's response; Worksheet 106 records how others with similar restrictions were treated; the defense playbook (133) carries the defense with the authorities this page cites and the facts that tend to support and weaken it.

Related roadmaps#

• Roadmap 012 — ADA Disability Discrimination Against Employees and Physicians.
• Roadmap 013 — FEHA Disability Discrimination.
• Roadmap 014 — Failure to Provide Reasonable Accommodation.
• Roadmap 015 — Failure to Engage in the Interactive Process.
• Roadmap 016 — Return-to-Work and Medical-Clearance Disputes.
• Roadmap 017 — Fitness-for-Duty Examinations and Employer Medical Inquiries.
• Roadmap 019 — ADA/FEHA Retaliation.

What this page cannot do#

This Roadmap cannot determine whether a specific person was safe to work, whether a provider opinion was correct, whether a risk was significant, whether a future event was sufficiently likely or imminent, whether accommodation could reduce risk, or whether a licensing or credentialing rule independently barred work.

Those questions require current objective evidence, the actual job, individualized medical and functional analysis, accommodation evidence and decision authority.