One of the Worst Things an Employer Can Ask For: Your Mental Health Records

Who Is Actually Asking: HR and Their Contractors

Before the legal framework, a word about who is on the other end of the request, because it is not always obvious. Demands for mental health records come from two sources, and both are acting on behalf of the employer.

The first is your own human resources department. A smaller or mid-sized employer typically handles FMLA leave internally. An HR representative sends the forms and collects the responses. If your HR team decides to push for records beyond WH-380-E, it is the same person you might see in the break room who is reading what comes back.

The second is a third-party administrator, often called a TPA or a leave administrator. Large employers outsource FMLA and short-term disability claims to companies like Sedgwick, The Hartford, Lincoln Financial Group, Unum, and Matrix Absence Management. The TPA decides whether your leave is approved and how long it runs. They are not your employer. They are a contractor your employer pays, and they answer to the employer, not to you.

The legal rules are the same in both cases. FMLA does not let an employer demand more medical information than the statute allows, and an employer cannot outsource that rule to a contractor. HR cannot ask for what HR cannot obtain through a contractor, and a contractor cannot ask for what HR could not obtain directly. Everything below applies to both.

What the Law Actually Requires

The grounding fact is that federal law requires much less than HR and leave administrators typically ask for. Three regulations matter.

FMLA certification: WH-380-E is the ceiling

When you request FMLA leave for your own serious health condition, your employer is allowed to request a medical certification. The federal form is WH-380-E. The form does not require a diagnosis. It asks for the date the condition began, the expected duration, and a functional description of what job duties you cannot perform and how often. That is the legal scope of what they can demand about your condition.

The regulation also draws a hard line against follow-up inquiries. Under 29 CFR 825.307(a): “If the employer has no reason to doubt the validity of the certification that it has received, the employer may not request additional information from the health care provider.”

If your provider completes WH-380-E and it covers the required fields, the inquiry should end. Employers and TPAs are not entitled to your therapy notes. They are not entitled to your diagnostic history. They are not entitled to a phone call with your clinician outside the narrow authentication and clarification process the regulation defines.

HIPAA psychotherapy notes: 45 CFR 164.508(a)(2)

HIPAA creates a stricter category for what it calls psychotherapy notes: the personal notes a mental health clinician keeps about your sessions, kept separately from your billing and diagnostic record.

45 CFR 164.508(a)(2) requires a separate, specific authorization to disclose these notes. The authorization cannot be bundled into a general medical release. A TPA cannot put a clause at the bottom of a boilerplate release and call it done. If they want your psychotherapy notes, they have to ask for them in a stand-alone authorization, and you have the absolute right to refuse.

ADA confidentiality: 42 USC 12112(d)(3)(B)

Under the Americans with Disabilities Act, employer medical inquiries must be job-related and consistent with business necessity. The EEOC’s 2000 enforcement guidance is explicit that an employer may not ask for a complete medical record, because such records are likely to contain information unrelated to whether the employee can perform the essential functions of the job.

The ADA also imposes a second duty. Medical information the employer receives must be kept in a confidential file separate from the personnel file. That duty continues after a TPA has sent the record to the employer. An employer who stores an FMLA certification or a therapist’s letter alongside regular personnel documents is already in violation of 42 USC 12112(d)(3)(B). This matters because the harm of overdisclosure is not infinite: records collected improperly still have to be handled with care afterward, and if they are not, that is its own claim.

The FMLA vs. Short-Term Disability Caveat

Almost everything above applies to FMLA, which is job protection, not wage replacement. Short-Term Disability insurance, often processed by the same TPA at the same time as your FMLA request, is different. STD is governed by the insurance policy contract and, depending on the plan, by ERISA. The policy typically requires the claimant to provide proof of loss sufficient to establish the disability. The carrier can legally condition payment on receiving records the FMLA regulations would not allow.

What this means practically: you can refuse a blanket release and still protect your FMLA leave. You cannot necessarily refuse a records request and still receive STD pay. If your finances depend on STD, talk to a benefits lawyer or call A Better Balance before you reject a release, because the right answer for you may be different.

Why This Is Clinically Harmful

Now that the law is on the table, the clinical frame matters.

Psychologist Jennifer Freyd’s body of work on institutional betrayal describes the psychological harm that occurs when institutions, whose role includes a duty of care, instead act in ways that violate that trust. Smith and Freyd’s 2014 paper in the American Psychologist is the canonical reference. Their argument: institutional betrayal exacerbates the impact of trauma, leading to increased anxiety, dissociation, and other trauma-specific symptoms.

In 2018, Holland, Cortina, and Freyd extended this framework to the specific situation of compelled disclosure, meaning being required to talk about a trauma regardless of whether the survivor wants to. Their finding: policies that compel disclosure can replicate the dynamics of the original abuse by stripping survivors of their autonomy and control.

Read that again. The dynamics of the original abuse. That is the clinical frame for what a TPA demanding a full mental health record is doing to a survivor. The power differential, the compulsion, the unilateral access to what is most private: these are not incidental features of a bureaucratic process. They are the features that make childhood abuse psychologically devastating in the first place.

A related finding from Cromer and Freyd (2020) in the Journal of Traumatic Stress: voluntary disclosure in a safe setting is one of the established mechanisms of healing, but disclosure under high institutional pressure erases that benefit and replaces it with harm. Courtois and Ford, in Treating Complex Traumatic Stress Disorders (Guilford Press, 2013), warn that premature exposure to traumatic memories in patients with complex trauma can lead to overwhelming affect, dissociation, and exacerbation of symptoms. The International Society for the Study of Trauma and Dissociation goes further: phase-oriented treatment is the standard of care for complex trauma, beginning with stabilization and safety, long before anything that resembles telling your story for someone else to read.

A records request from HR or a leave administrator bypasses this clinical sequence. It forces the survivor to contemplate trauma material, to think about what is in the record, what the clinical language says, and who will read it, outside any therapeutic container, on someone else’s timeline, under threat of losing their income.

A Pattern of Overreach

HR departments and leave administrators have both drawn legal fire for asking for more than the law allows. Two decades of litigation and regulatory action have documented the pattern. The examples below focus on TPAs because that is where the largest public settlements and published decisions sit, but courts have applied the same reasoning to employers who handle leave internally.

In Arango v. Work & Well, Inc., 930 F. Supp. 2d 940 (N.D. Ill. 2013), a federal district court denied a TPA’s motion to dismiss, holding that a TPA could be held liable as an employer under the FMLA when it substantially controlled the leave approval process, including by requiring medical information beyond what the statute permits. This is district-level authority, not a binding rule in every circuit. Some federal courts have been more reluctant to hold TPAs directly liable. But the reasoning in Arango has been cited in other cases challenging TPA records practices, and it stands for the basic proposition that an administrator cannot hide behind the employer to demand what the employer could not demand directly.

The most consequential regulatory action is the 2004 Multistate Regulatory Settlement Agreement with Unum Group, entered into after multi-state insurance regulator investigations into unfair claims-handling practices. A core issue was Unum’s aggressive demands for extensive medical information, often paired with “independent” medical examinations conducted by reviewers who never treated the claimant. Unum paid hundreds of millions in claim reassessments and fines, and the agreement was later extended with additional claims-handling commitments.

The point is not that every HR representative or claims examiner is acting in bad faith. The point is that the system is set up to demand more than it is entitled to, because demanding more is cheap and survivors pushing back is rare. The default request goes out to everyone, and the handful who object are the only ones who get the narrower, lawful request they should have received from the start.

Why This Is Worse for Survivors of Childhood Sexual Abuse

Childhood sexual abuse is more common than most people acknowledge. The original CDC-Kaiser ACE Study (Felitti et al., 1998, American Journal of Preventive Medicine), surveying over 17,000 adults, found that 20.7% reported childhood sexual abuse. Stoltenborgh et al. (2011) in Child Abuse & Neglect reported a global meta-analytic prevalence of 12.7%, with North American rates between roughly 15% and 22%. Research from the Crimes Against Children Research Center at UNH has reported rates in the range of 26% of girls and 5% of boys by late adolescence.

The working-age adult population includes millions of people for whom a TPA records request is not a paperwork problem. It is a question of whether the only space where they have ever been believed, a locked file in their therapist’s office, is about to be opened by a stranger who is paid to find reasons to deny their claim.

A second wound: for the vast majority of these survivors, the criminal justice system has never delivered any accountability for what was done to them. According to national data discussed by RAINN, out of every 1,000 sexual assaults, approximately 975 perpetrators walk free. CHILD USA documents the statute-of-limitations problem in detail: survivors take on average 14 to 22 years to disclose childhood sexual abuse, by which point the criminal window has closed in most states.

So the person sitting at their kitchen table staring at a portal request, whether from HR or from a contractor, has usually carried privately a story that was never legally named and never legally vindicated. Handing that story over is a reenactment of the dynamic that made the original abuse unbearable: the ones with power get to know, and get to decide, and you do not.

This is what Holland, Cortina, and Freyd meant when they wrote that compelled disclosure replicates the dynamics of the original abuse. That sentence is not metaphorical. It is a clinical description of what happens.

What to Do

Nothing in the legal or clinical analysis above changes the fact that you may still need your leave approved, or your STD pay to arrive. You are not powerless, but you have to know your rights and use them deliberately.

1. Have your therapist write a functional-impact letter. This is the single most effective move most survivors do not know about. Your therapist can write a short, free-standing letter describing what job duties you cannot currently perform and how long the restriction is expected to last, without attaching any portion of the underlying record. Most employers and TPAs will accept this, paired with a completed WH-380-E, in lieu of further records.
2. Do not sign the blanket release as written. Return it with targeted edits. Strike lines authorizing “all mental health records” or “any medical records.” Limit the scope to records relating to the condition for which you are requesting leave. Limit the time period to the current episode. Strike any re-release clause that sweeps in unrelated third parties. Caveat: if you are also seeking paid STD, a heavily redacted release may trigger an STD denial. Call A Better Balance first.
3. Submit only the completed WH-380-E. The regulation is explicit: if the certification is complete and sufficient, they cannot demand more (29 CFR 825.307(a)). Send the form. If they push, ask them to cite the legal authority for the additional request.
4. Escalate inside your company, not just at the TPA. TPAs are agents of the employer. Your internal HR or benefits team can, if they choose, accept the FMLA certification directly and instruct the TPA to approve the job-protected leave. Going over the TPA’s head sometimes works where arguing with the TPA does not.
5. Refuse authorization to release psychotherapy notes. They must ask for these separately under 45 CFR 164.508(a)(2). Say no, in writing. If a TPA conditions approval on release of psychotherapy notes, that conduct is reportable to the HHS Office for Civil Rights.
6. Insist on written communication. Every phone call from a TPA, every “quick clarification,” is an opportunity for something to be said that goes into the file differently than it was meant. Email only. Keep every message.
7. File a DOL complaint if the TPA keeps pushing. It is free. You do not need a lawyer. The U.S. Department of Labor Wage and Hour Division investigates FMLA interference.
8. Call A Better Balance. Their free legal helpline (1-833-633-3222) is staffed by employment attorneys who specialize in leave laws. A 30-minute call will tell you whether the TPA is over the line.

Frequently Asked Questions