They can't ask for private medical information