(MONEY Magazine) – Answer true or false. Legally, your boss can: Rifle through your desk drawers. Videotape you without your knowledge. Read E-mail and computer files addressed solely to you. Eavesdrop on your phone calls. Require you to lose weight.

If you answered false, even just once, you need to read this article. Unfortunately, whatever your profession, privacy on the job is woefully fragile, leaving you far more vulnerable to career-threatening intrusions than you may think. For instance:

Last year, a client of Cliff Palefsky, co-chairman of the privacy committee of the National Employment Lawyers Association, was fired after his boss learned of a sarcastic E-mail message that the client had sent a colleague: In effect,the manager called the firm's just-released financial report phony baloney. His boss summarily dismissed him, citing lack of company loyalty as the cause. Although the case was settled out of court within weeks (including a stipulation that the company name and settlement amount remain confidential), the manager did not get his job back.

At a Florida consulting firm, a male executive's marriage was destroyed last year after a vindictive v.p. tapped the exec's phones to prove that he was having an affair with a female co-worker. The v.p. then read transcripts of the incriminating tapes to the exec and his wife (who happened to be the boss' daughter). The female co-worker sued the company for invasion of privacy and wiretapping, and the case was settled out of court for an undisclosed sum.

Joy V. Miller, a Motorola factory worker, told a company nurse that she had undergone a mastectomy and reconstructive surgery, after the nurse promised confidentiality. Miller alleged that the nurse then told a colleague about the illness in 1987. Miller sued the company, claiming the incident had caused "severe.mental and emotional distress." She won on appeal but opted for early retirement because of the distress the incident caused her.

"Few workers realize that there is no federal law that protects their privacy on the job," says Gerard Panaro, attorney and author of Employment Law Manual. Although some state laws provide limited protection, management spying-or inadvertent information leaks-can trigger worse consequences than mere embarrassment. You could lose your job, your professional reputation or your future earnings potential. And once your privacy has been violated, there's no going back.

But there are precautions you can take. To learn how best to protect your secrets at work, Money interviewed more than a dozen employment lawyers, consumer-privacy advocates and human-resources personnel. Here's what the pros recommend:

Keep your electronic files squeaky clean. "There is no federal law that prohibits an employer from reading any E-mail or computer files," reports Milind Shah of the American Civil Liberties Union's Task Force on Civil Liberties in the Workplace. And many companies do: A 1993 MacWorld magazine survey reported that one out of every five U.S. companies admits they search employee electronic files. Nearly 74% of the 301 companies polled monitored electronic work files, 42% peered at E-mail messages, and 15% of them eavesdropped on phone voice mail. Such spying is especially frequent in the United States. A 1993 United Nations International Labor Organization survey of workplace surveillance in 19 countries found that U.S. workers are the most watched employees on earth. Help may be on the way in the form of the Privacy for Consumers and Workers Act, sponsored by Sen. Pat Williams (D-Mont.). But the bill, which would set limits on telephone, video and computer monitoring, is in limbo, awaiting a congressional vote.

Your best protection is to refrain from sending any computerized or voice-mail messages that you wouldn't post on a bulletin board. Remember too that even after you "delete" files or messages, they can often be retrieved from the computer's memory banks should an investigation arise. Many companies also back up files on a central system without telling employees.

Don't broadcast your medical history. Although 69% of Americans now favor a law that would keep their medical information confidential, according to a 1993 Equifax/ Louis Harris poll, there is still no comprehensive federal law that guarantees medical privacy. The 1990 Americans With Disabilities Act (ADA) does include some vaguely worded medical-privacy protection. But, says Craig Cornish, co-chairman of a subcommittee on workplace privacy of the American Bar Association, "We won't know how the law will be interpreted until cases start popping up."

Even so, says Cornish, once "your colleagues know that you are, say, manic-depressive, you can never regain that lost privacy." Then, if you decide to test the law or file a workers' compensation claim, your remedy may be worse than the injury: Any germane information in your medical file could become public.

Don't volunteer embarrassing or delicate information in your medical records, say the pros, if you have any doubt about your employer's ethics. By the same reasoning, think twice before consulting company doctors for treatment of sensitive problems, such as sexually transmitted diseases.

Be cautious about company counseling. Now offered by 83% of companies, EAPs (employee assistance programs) provide free, "confidential" counseling services for you and family members. Most firms, of course, have the best of intentions. GTE, for example, has a 20-year-old EAP and, says its manager Mary Bernstein, "If you don't have a confidential program, no one will use it. We stick to our guns about this."

Nonetheless, your employer is legally entitled to review EAP sessions in several ways. At the outset, for example, the EAP counselor may request that you sign a release waiver. Depending on how the waiver is worded, you could be signing away the confidentiality. As with medical records, if you file a workers' compensation claim or sue your employer for, say, wrongful termination, your "confidential" EAP records can often be subpoenaed by your employer and used against you in court. If, for another example, an employee asks for help because he's suicidal, the counselor may be legally able to notify authorities. More disconcertingly, a manager may simply request information about you from the EAP administrators, perhaps trying to be helpful. "Companies are not supposed to do this," says Palefsky, "but I know it happens."

If an EAP counselor asks you to sign a release waiver, Palefsky suggests you write an individual "limited" version that would hold up in court. For instance: "You may notify my employer that my emotional condition requires that I be assigned to a less stressful job. You may not describe that condition." If the counselor ignores the waiver, in most states he or she can probably be sued for invasion of your privacy.

Personal habits count. Some employers try to monitor your behavior off the job, as well as from 9 to 5. To control benefits costs, for example, companies sometimes insist employees join so-called wellness programs that require changes in your daily habits. Panaro says some even forbid dating among employees in order to avoid sexual-harassment charges. Depending on what state you live in, you may need to comply-or find another employer. Only three states (Colorado, New York and North Dakota) have laws that protect employees against job discrimination for any legal activity they pursue outside working hours. In 25 states, including Arizona, Connecticut and Indiana, laws forbid discrimination only against workers who smoke off the job. But a staggering 22 states have no lifestyle protection laws whatsoever. Bottom line: In 47 states, your boss may mandate whether you can be romantically involved with a colleague or engage in activities the company deems risky, such as riding a motorcycle or skydiving. Says the ACLU's Shah: "Most employees are surprised to find that what they consider unethical behavior by their employers is actually legal."

If your company's policy on personal lifestyle or habits seems unreasonable, check your legal protection by calling the organizations listed on page 31. Most employers try to respect employee privacy, yet all it takes is one misstep-a thoughtless E-mail message or an offhand comment to the wrong person-and you could hurt your livelihood. Warns Panaro: "Until the laws become stronger, employees must be very cautious about the personal information they release to colleagues and bosses."

BOX:

WHERE TO GET LEGAL HELP

ACLU's National Task Force on Civil Liberties in the Workplace 212-944-9800 Can explain state privacy laws and advise you about legal claims

National Employment Lawyers Association (NELA) 600 Harrison St., Suite 535 San Francisco, Calif. 94107 Will refer you to local privacy lawyers

Your state labor department (The phone number appears in your directory's Blue Pages.) Can inform you about any laws on off-hours conduct