An Employer Asks If My Client Showed Up: What You May Confirm

Can you confirm attendance without an authorization?

No. A confirmation that a named person attended therapy is protected health information, and the Privacy Rule bars a covered clinician from disclosing it without a valid authorization unless some other permission in the rule applies 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.508 — Uses and disclosures for which an authorization is required..That a covered provider may not disclose protected health information, including a bare confirmation that a named person attended, without a valid authorization absent another permission; the six core elements a valid authorization must contain; the five defects that make an authorization invalid; and the rule that psychotherapy notes require a separate authorization combinable only with another psychotherapy-notes authorization.. The word yes carries the same information a summary letter would: this person is your client, and they sat in your office on Tuesday.

One permission that needs no authorization runs to treatment, payment and health care operations 2Ref 2U.S. Department of Health and Human Services (Office for Civil Rights) (2026).§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations..The permission structure that requires no authorization for treatment, payment and health care operations. Used only to state what that lane covers, so the reader can see that an employer's or EAP's attendance question is handled through an authorization instead.. An employer calling about an employee sits outside that frame, and the fact that the employer or its employee assistance program pays for the sessions does not move it inside. Whether a particular EAP is a covered entity, a business associate of one, or neither depends on how that program was built, and no general rule settles it for every EAP.

But you do not have to settle that question to handle the call. A signed authorization from the client makes the disclosure lawful whichever box the EAP sits in, and without one there is nothing to say in any of them.

HIPAA is a federal floor. State confidentiality and licensing laws can add limits on top of it, so a release that clears the federal rule is not always the end of the analysis.

Clinicians who contract directly with self-funded employers, TPAs, and brokers meet this call more often than most. The contract does not change the answer, because the confidentiality obligation runs to the client and not to the party paying the invoice.

The one exception, and what it requires

One lane in the Privacy Rule lets a provider disclose to an employer with no authorization, and it is narrow. It applies only where you furnished the care at the employer's request, for workplace medical surveillance or to evaluate a work-related illness or injury 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required..The narrow employer lane at (b)(1)(v) and its four cumulative conditions: care furnished at the employer's request for workplace medical surveillance or evaluation of a work-related illness or injury, disclosure limited to findings, the employer's recordkeeping or surveillance obligation, and written notice to the individual at the time care is provided or posted prominently at the work site.. Ordinary psychotherapy that an employer happens to fund is not that, and neither is a course of sessions an EAP referred.

The conditions are cumulative, so failing any one of them closes the lane 3Ref 3U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.512 — Uses and disclosures for which an authorization or opportunity to agree or object is not required..The narrow employer lane at (b)(1)(v) and its four cumulative conditions: care furnished at the employer's request for workplace medical surveillance or evaluation of a work-related illness or injury, disclosure limited to findings, the employer's recordkeeping or surveillance obligation, and written notice to the individual at the time care is provided or posted prominently at the work site.:

• the care was furnished at the employer's request, for workplace medical surveillance or to evaluate a work-related illness or injury;
• what leaves the practice is limited to findings concerning that illness, injury or surveillance;
• the employer needs those findings to meet a recordkeeping or workplace medical surveillance obligation of its own;
• the individual receives written notice that the information goes to the employer, given at the time the care is provided, or posted prominently at the work site where the care happens there.

The notice condition is the one a solo practice is likeliest to overlook, because it lands at the start of care, months before anybody asks a question. A practice that does occupational work of this kind writes the notice once and gives it at intake.

Everything else goes through the client.

What a valid authorization has to contain

Six core elements, and the form is only as good as its narrowest one. HIPAA requires a description of the information that identifies it in a specific and meaningful fashion, the person or class authorized to make the disclosure, the person or class who may receive it, each purpose of the disclosure, an expiration date or event, and the individual's signature and date 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.508 — Uses and disclosures for which an authorization is required..That a covered provider may not disclose protected health information, including a bare confirmation that a named person attended, without a valid authorization absent another permission; the six core elements a valid authorization must contain; the five defects that make an authorization invalid; and the rule that psychotherapy notes require a separate authorization combinable only with another psychotherapy-notes authorization.. An employer's own template often runs wider than the question it was sent to answer.

Read the form against the five defects that make it invalid: the expiration date has passed or the expiration event is known to have occurred, a required element is not filled out completely, you know it has been revoked, it breaches the rules on combining or conditioning authorizations, or it carries material information you know to be false 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.508 — Uses and disclosures for which an authorization is required..That a covered provider may not disclose protected health information, including a bare confirmation that a named person attended, without a valid authorization absent another permission; the six core elements a valid authorization must contain; the five defects that make an authorization invalid; and the rule that psychotherapy notes require a separate authorization combinable only with another psychotherapy-notes authorization..

A required element left blank makes the authorization invalid, which means the disclosure it appears to permit is not authorized at all.

The description field is where a broad form becomes a workable one. Wording that names the dates on which the client attended scheduled appointments in a stated window, and nothing further, authorizes an attendance confirmation. Wording that says treatment records authorizes the chart. When the client means the first and the form says the second, the fix is a corrected form, not a private decision about how much of it to honor.

Mandatory progress note contents are set by other rules and by your license, and they do not shrink because an employer might one day ask. What a release reaches and what the record must hold are two separate questions.

Psychotherapy notes need their own form

A general release does not reach psychotherapy notes. HIPAA requires a separate authorization to disclose psychotherapy notes, outside a short list of exceptions that does not reach an employer's request, and that authorization may only be combined with another authorization for psychotherapy notes 1Ref 1U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.508 — Uses and disclosures for which an authorization is required..That a covered provider may not disclose protected health information, including a bare confirmation that a named person attended, without a valid authorization absent another permission; the six core elements a valid authorization must contain; the five defects that make an authorization invalid; and the rule that psychotherapy notes require a separate authorization combinable only with another psychotherapy-notes authorization.. So one employer form cannot cover the chart and the notes at once, however broadly it is worded, and a request arriving under a single signature reaches the record only.

The practical work is a sorting question before it is a legal one: whether the material the employer is asking about lives in the progress note or in the separate notes. Content that was never separated is in the record, and a release that reaches the record reaches that content with it.

If you are a Part 2 program, the form is different

If your practice is a Part 2 program, the release is not a HIPAA authorization at all. Part 2 governs federally regulated substance use disorder treatment rather than behavioral health practice generally. It requires its own written consent, and the required elements include the patient's name, which HIPAA's core list does not itself demand 4Ref 4U.S. Department of Health and Human Services (SAMHSA / Office for Civil Rights) (2025).42 CFR § 2.31 — Consent requirements..That a Part 2 substance use disorder program releases information on a written Part 2 consent whose required elements differ from a HIPAA authorization, including the requirement that the consent name the patient. Cited only in the paragraph that limits itself to Part 2 programs.. A form that satisfies one rule can fail the other.

Check which rule your practice sits under once, and write the answer where whoever answers the phone can see it. The question returns every time a release does.

What to do when the call comes in

Treat it as a non-routine disclosure and review it on its own. The Privacy Rule splits disclosures in two: routine and recurring ones can run on a standard protocol, and for everything else the practice must develop criteria limiting what goes out and then review each request individually against them 5Ref 5U.S. Department of Health and Human Services (Office for Civil Rights) (2025).45 CFR § 164.514 — Other requirements relating to uses and disclosures of protected health information..The implementation specifications at (d)(3): standard protocols for routine and recurring disclosures, and the duty to develop criteria and review all other requests on an individual basis. Used for the claim that a one-off employer or EAP request is a non-routine disclosure requiring individual review.. An employer or EAP call is the second kind, every time.

The sequence that follows from that, in the order it happens:

1. Confirm nothing on the first call. A common convention is a neutral line: the practice does not confirm or deny whether anyone is a client without a signed release. It works because you say it about everybody, including people who are not clients. 2. Ask for the signed authorization in writing and read it against the five defects before you rely on it. 3. Read the description field and decide what it authorizes: attendance dates, or the record. 4. Talk to the client before anything goes out, including where the release is unquestionably valid. 5. Send only what the form names, then log the date, the recipient, the purpose and the exact content disclosed.

The instinct that governs presenting a client in consultation applies to step five as well: name what the stated purpose requires and stop there. An authorization sets the outer edge of what may go out, and nothing obliges you to fill it.

A client who sees what a release would reach sometimes follows it with a client's request to destroy records, which is a separate question with a separate answer. Answer the one in front of you first and calendar the other.

When the employer wants a fitness-for-duty opinion

That request is a different one, and it asks you to change roles. Confirming attendance reports a fact from your own calendar. An opinion about whether an employee can safely perform their job is an evaluation, produced for the employer, with the employer as the party the report serves. Many clinicians decline that role from inside a treating relationship and refer the employer to an independent evaluator.

The swap is harder than it looks. The authorization would have to name that opinion as a purpose of the disclosure, so a form signed for attendance does not carry it. And a fitness opinion turns on job duties and workplace demands that a treating clinician usually has only from the client's account.

Whether to take an evaluation role at all is a decision to make against your board's rules and your liability carrier's terms, before a request arrives rather than on the call.