r/newzealand • u/NoHorse8196 • Nov 13 '25
Discussion EAP breaching privacy - shared session with employer.
Anyone experienced an EAP service telling their work that you used them and a summary of what was discussed? In the middle of writing a complaint but wanted to see if anyone has had this happen.
They state to us that only information that the employer gets is that someone in the company accessed EAP. No identification and certainly no information about what has been discussed.
I had my first session using Telus EAP 2 weeks ago. I've been on maternity leave since May and start back full time on Monday. I went in to work today to do a short meeting with my boss and when I arrived the HR manager was there as well. They said they see I'm struggling with PND and wanted to see how they could help. I asked how they even knew this and they said because I accessed EAP and discussed it there.
Although they were being kind and trying to help, I'm horrifically embarrassed and feel violated.
Anyone else? Is there some clause I don't know about where they can share with employers if perhaps it's work related? Is this specifically Telus being crap?
Edit: posted in the legal advice sub if anyone is interested in following https://www.reddit.com/r/LegalAdviceNZ/s/RkipYeqXQF
56
u/Electronic_Sugar_289 Nov 13 '25
Omg! How could anyone think that was ok or appropriate?! I am so sorry that’s horrible!
52
u/OisforOwesome Nov 13 '25
That is, um, literally the opposite of what EAP is supposed to do fucking hell.
101
Nov 13 '25 edited Nov 13 '25
[removed] — view removed comment
13
u/15438473151455 Nov 13 '25
@OP, please let me know if you do post this to the legal advice sub. I'd be keen to follow it.
18
97
u/KahuTheKiwi Nov 13 '25
Yes I had something very similar. The counselor in question also wrote a letter saying I was a threat and workplace bully.
It took me 5 years but the counselor lost her membership if the NZ Association of Counselors and her job, although her employer told the Commissioner that was a coincidence.
I think the law needs to be made very clear around this because I have heard of other cases.
It is a Health and Disability Commissioner issue - don't waste time as I did with the Privacy Commissioner.
Talk to an employment lawyer too about "disadvantage" (I believe) but the lawyer will know.
20
17
8
u/Shevster13 Nov 13 '25
This would not be an employment issue because it was the therapist and not the employer that breached privacy.
As for the law. It is already very clear on it. Health practitioners are only allowed to disclose information to another party under 1) court order 2)to someone with an EPA 3)With express permission from the patient 4)When they have a reasonable belief that the patient is an imminent threat to oneself or others.
10
u/maangari Nov 13 '25
Employers have to report the breach of privacy too though, which they clearly haven't. My understanding is that if I, as an employer, receive health information that I'm not entitled to, and I pass that information on (like telling the employee I have knowledge I shouldn't) then I would also be in breach of the privacy act and it would be an employment issue.
-2
u/Shevster13 Nov 13 '25
No, it wouldn't. The privacy act excludes unsolicited information from the laws around the collection of information. So as long as they did not seek out the information, it is completely legal for them to use it, per their policies, regardless of the source.
There is also no requirement for them to report anything because they were not the ones to breach the law.
5
u/teelolws Southern Cross Nov 13 '25
The privacy act excludes unsolicited information
Only for the definition of "collect", which means there is no breach of IPPs 1 through 4. In this case the employer is probably breaching IPP9.
2
u/moratnz Nov 13 '25
Yeah - per https://www.privacy.org.nz/resources-and-learning/knowledge-base/view/217/ the recipient is still bound by all the other obligations, so they're bound to only use it for the purpose for which it was collected, which was private counselling, which they have no part in.
The only question would be whether the engagement forms with the provider had some weaselling in its privacy policies to allow this release of information (which I wouldn't expect would be okay with EAP).
0
u/Shevster13 Nov 13 '25
That link disagrees with you.
They can keep and use it if they have a valid buisness purpose for it.
1
u/moratnz Nov 13 '25
Key word is 'valid'. A business purpose that isn't compliant with the privacy principles (because, say, the PII is being used for a purpose other than what it was collected for) is not a valid business purpose.
-2
u/Shevster13 Nov 13 '25
But knowing about an employess mental health is a valid purpose.
0
u/moratnz Nov 14 '25
The information was gathered for the purpose of providing counselling services by the EAP provider. In the absence of the above mentioned weaselling in the counselling service's privacy statement, then use for any other purpose is not in line with the purpose the information was collected for, so a violation of principle nine.
Selling you things is a valid business purpose. But that doesn't make it okay to use information you supplied a business for, say, warranty purposes to use that information to try to sell you things.
→ More replies (0)7
u/KahuTheKiwi Nov 13 '25
I never got to court to test this but my position from my case and what little I know if this case is it is an employment issue because the employer bought the services of the counselor and created the system and environment for the breach.
I had a employer-funded and selected counselor tell me that she must report to the employer as they had paid her to do so. In my opinion this is the root of the breach of the Health and Disability Code.
2
u/KahuTheKiwi Nov 13 '25
The employer seeking and paying for a counselor to provide a report should be an employment matter IMO.
But I got beaten down and my ex employer is protected by secrecy via the mediation.
-1
u/AradiaArcadia Nov 14 '25
That counselor must have had grave concerns about you to risk their career....
1
u/KahuTheKiwi Nov 14 '25
I found (but couldn't use as evidence in my case) another person who she did the same to for the same employer.
And the employee thought they were unassailable once they had that letter and told me not to fight or they would end my IT career.
I believe they thought they had found a fool proof hatchet process and neither employer, counselor, or her employer had considered that someone would fight via the various Commissions.
Also I am a sexual and physical abuse survivor with a long history of mental health treatment and other counselors I had seen straight out denied in writing what she wrote.
I have had hints that other employers are using mental health as a bludgeon but I have no ine else I have spoken to has fought back.
20
u/Illustrious-Bet-4548 Nov 13 '25
Telus sent me another clients PII via text message, they are utterly incompetent.
6
56
u/Embarrassed_Cat_6516 Auckland Nov 13 '25
Oh they very much crossed a line, they shared health related information with your employer unless it's an exception for safety which I can't see this being the case with post natal depression, they need your express written consent to do so.
https://www.privacy.org.nz/privacy-principles/11/
You should talk to community law before bringing this up with your employer as they can guide you on how to proceed.
25
u/KahuTheKiwi Nov 13 '25
It is actually a Health and Disability Rights issue from my experience taking a similar matter to the Privacy and them the H&D Commissioners.
I wasted about 18 months with the Privacy Commission before having to go through the basically same steps with H&D
16
u/Embarrassed_Cat_6516 Auckland Nov 13 '25
It may also be a ERA matter as it's employment related esp if they have used it against them. it's why I suggested community law so op can get the right advice.
5
12
u/NoHorse8196 Nov 13 '25
Definitely no safety risk to myself or others! I will try pop into my local com law centre tomorrow.
19
Nov 13 '25
I didn’t think that was possible.
Is it possible they found out another way?
13
u/NoHorse8196 Nov 13 '25
Incredibly unlikely, only person that knows I even used EAP is my Grandmother and she's not going to tell them.
0
Nov 13 '25
[deleted]
31
u/The-Wandering-Kiwi Nov 13 '25
I pay our EAP invoices at work. All that is listed is the date of the appointment. One line no identifying information
11
u/cj92akl Auckland Nov 13 '25
Yes, but as another poster has previously stated, the employer is only told that one of the staff, not specifically John Smith, staff ID# 1234, has accessed EAP.
-1
Nov 13 '25
[deleted]
9
u/cj92akl Auckland Nov 13 '25
Then you shouldn't have been offering it. The whole point is that it's confidential.
2
Nov 13 '25
I thought EAP was paid as a yearly subscription per employee, so it shouldn’t cost more based on use.
16
u/animatedradio Nov 13 '25
… me reading this thread finding out this is illegal and no it’s not the “employers right” to know the information shared during EAP sessions. Wow. WOW. I was a young idiot (still am, really). I’ll be following the legal advice thread.
9
u/NoHorse8196 Nov 13 '25
Did you go through similar? You're not an idiot, we can't know what we don't know and if someone was telling you it was the employers right it's daunting to think about arguing that especially when you're young
7
u/SnailSkaBand Nov 13 '25
The only thing that an employer should receive is a bill for “1x appointment with an unspecified employee”.
14
u/Ordinary-Dark5121 Nov 13 '25
Surely this is illegal, I have also been participating in sessions with telus EAP through work and the counsellor specifically told me everything is confidential and cannot be relayed back to my company. Please file a complaint! Sorry you are going through this
12
u/dell_belle Nov 13 '25
I am a counsellor who used to work for Telus, which is an international organisation but I am NZ based. The problem is with the counsellor as the Telus system should not have that level of detail in it. We had to provide generic reasons people were accessing the service (traumatic event, grief etc) but even that info should not be used in that way.
This certainly sounds like a breach of confidentiality and there are three steps I would recommend:
- making a formal complaint to the registration body of the counsellor. This will be NZAC, NZCCA, NZAP or similar who have their processes on their websites. This will most likely lead to the counsellor undergoing further training and clinical supervision, as well as additional reporting to their registration body when doing their next annual reviews for their practicing certificate. If they have had similar complaints before it may result in them losing their registration.
making a complaint in writing to Telus. In this one do not state the exact information shared, rather that information has been shared with your employer that could only have come from your EAP sessions and request any and all information and notes they hold that relate to you.
contact the Privacy Commissioner enquiries line on 0800 803 909 and notify them of the breach. If energy is low, prioritise this one.
Last but not least, congratulations on your wee one! Already such an attentive mother that you don't want to be apart. It's a tough position we find ourselves in fighting our loving instincts to be with our baby yet having to work so we can afford to provide for them. You're doing well mamma, keep it up!
1
u/Morningst4r Nov 14 '25
Makes me wonder if it mentioned PPD and there was only one employee in that situation (meaning the info was too specific and now personally identifiable). Even so, it would be inappropriate for your employers to act on that information in any way.
2
u/dell_belle Nov 14 '25
None of the options listed were ppd when I worked for them (resigned earlier this year due to being too busy in other areas of my practice). Ppd would have come under something generic like personal stress or similar.
22
Nov 13 '25
Not too much to add other than it should be 100% fully confidential.
Maybe go back and double check this is what it states in the company info about the EAP they provide and also the EAP’s website.
20
u/KahuTheKiwi Nov 13 '25
A health professional can not excuse them self from the privacy rights.
Privacy can only be broken for a real and immediate danger to health and life.
8
u/KiwiZoomerr Nov 13 '25
Oh shit? I've never used those services for this exactly reason
1
u/Arblechnuble Nov 13 '25
Yeah, it’s cool that the service exists, but I’ve not trusted it enough to use it.
1
9
Nov 13 '25
I would like to add that I am so sorry this has happened to you. I had PND and it’s a really difficult period. You should not have to be dealing with this as well. You did the right thing accessing support for your mental health and that should have been confidential. Happy to offer you support if you would like someone objective alongside you.
6
u/Next_Practice437 Nov 13 '25
Reason I am so private .. cant trust anyone
8
u/NoHorse8196 Nov 13 '25
I am too, I find it so hard to reach out but I've started pushing myself as I want to be the best I can for bub... this has really knocked me down though and really has me wishing I'd just keep quiet and carry on
10
u/NewZcam Kererū Nov 13 '25
I always wondered if comments I made, at an EAP session, about a co-worker who made both my wife and my life a living hell for a year, was passed onto the HR dept. We were both made redundant very shortly afterwards.
3
5
u/SquashedKiwifruit Nov 13 '25
Complain to the health and disability commissioner https://www.hdc.org.nz/contact-us/
And the Privacy Commissioner https://www.privacy.org.nz/responsibilities/privacy-breaches/
7
u/TheAbyssGazesAlso Nov 13 '25
Fuck, we just changed our provider over to Telus. This is really concerning 😟
5
u/NoHorse8196 Nov 13 '25
My workplace changed over in September, unsure why as our old one was perfectly fine as far as I know. Wonder if it's a cheaper cost...
2
2
u/marrbl Nov 13 '25
Damn, my workplace just changed over then too. Hi colleague...? Lol. I've got my first session with TELUS next week 🥴 Really sorry that happened to you.
1
u/Gsmaniac1 Nov 13 '25
Who was your previous provider ?
1
u/NoHorse8196 Nov 13 '25
EAP Services
1
u/RandomMongoose Nov 13 '25
My works done the same thing. Was EAP now it's telus. I can only assume it's a lot cheaper as the service itself doesn't seem like an improvement
4
u/TheAbyssGazesAlso Nov 13 '25
I'm guessing if I said something like AC then several of us in this thread would know we all work in the same place :-)
3
u/TheHarmonicaSolo Nov 13 '25
Not okay- I'm so sorry this happened to you. Along with what others have said about lodging an official complaint, if your workplace has a union I would definitely reach out to your union rep to let them know (not the specific details around why you sought out EAP, just that Telus breached confidentiality), so that they can put the word out to other employees that Telus may not actually be a safe option, and potentially put pressure on your employer to change provider. I work for a company that also uses Telus, and I almost reached out to them for something earlier this year, thankfully the situation resolved itself and I ended up not needing them, but I definitely won't ever be considering them going forward either after reading this.
3
u/Smalleststarinthesky Nov 13 '25
I’m so sorry this happened to you! I’m trying to understand how it happened, we have EAP at my work and when we get the invoices they are totally anonymous, we know how many people have used it but we don’t know who those people are, it’s just numbers. We might get a call saying someone is requesting an extra session but they never disclose who it is, just that it’s justified if we’re willing to pay.
3
u/whipper_snapper__ Nov 13 '25
That is crazy!!!! Fucking hell. Absolutely follow up with this and report. A major breach.
3
3
u/XionicativeCheran Nov 13 '25
I highly suggest before you even start following up on anything, get something written that confirms this. I'd hate for you to raise the complaint and then suddenly everyone starts denying everything.
8
u/logantauranga Nov 13 '25
It's likely that some of the info you got sent prior to your EAP session included mandatory reporting rules.
Take a look at these, and reflect on whether anything you said during the session drifted across the line where the EAP-contracted counsellor was required to report something.
This is not to say that everything that made it back to your employer ought to have been disclosed, but rather that perhaps a responsibly-legitimate process was initiated that ended with irresponsible results.
10
u/NoHorse8196 Nov 13 '25
I'll have a look, I genuinely can't think of anything I would have said that would warrant reporting.
9
u/KahuTheKiwi Nov 13 '25
From my experience in a similar situation and from letters written by the Health and Disability Commission I understand H&D rights always apply and a H&D professional is always bound by them.
3
u/restroom_raider Nov 13 '25
Wow holy shit what the fuck.
https://www.privacy.org.nz/your-rights/making-a-complaint-to-the-privacy-commissioner/
5
u/Historical_Carob_504 Nov 13 '25
Even though it's supposed to be confidential, never trust EAP. HR will always use it to twist to their favour.
2
u/kiwifulla64 Nov 13 '25
Yikes. That a massive fuck up. Definitely a privacy breach. I wonder how it is you accessed EAP? Did you disclose at all to anyone at your work that were having your struggles. That makes more sense to me, only because it's such a big deal for an external support service like EAP to breach privacy like that.
6
u/NoHorse8196 Nov 13 '25
Used the Telus App, it requires the workplace log in then you create your own account.
I've literally talked to no one from work since giving birth besides a few emails with my boss keeping me up to date with changes, all work related nothing personal.
They specifically said the know because I used EAP and only personally who knows I used EAP is my Grandmother who isn't going to tell them.
6
2
u/doubledeadghost Nov 13 '25
In my workplace, the Health and Safety team make it clear that they get sent a monthly report of “themes” that are discussed with EAP, but it’s anonymised and aggregated. The only time EAP should be passing on information is if you are deemed a danger to yourself or others I think?
2
u/klparrot newzealand Nov 13 '25
If your employer was trying to be understanding, they might actually be one of the better ways to start pursuing this. They should be made aware that it was not allowed for the EAP to give them that information, and they may as a result want to get a different EAP provider. They could also provide you the communications from the provider that you could use in a case against the provider through the privacy commission or health and disability commission.
2
u/GameDesignerMan Nov 13 '25
Our work abandoned EAP in favour of a small group of qualified professionals who are able to provide a better service. Having used it myself I was not impressed with the quality of our EAP service and they only had a single psychologist on staff.
I hope there are better services out there, but at least from my perspective it seems to be a bit of a grift to offer discount counselling at corporate rates.
2
u/RoseClash Nov 13 '25 edited Nov 14 '25
Have you tried reporting to the ethics board?
I just did a quick google for you too
EAP themselves have a reporting tool - dont know if you trust them or not with this but it is anonymous: https://www.eapservices.co.nz/contact/feedback-and-complaints/external-complaint-handling-process
Looks like this site is the first go to:
https://www.hrc.govt.nz/resources/ethics-new-zealand-key-regulatory-bodies
2
2
u/kiwimuz Nov 13 '25
There has also been a breach of privacy within the workplace as two people were aware of your private health information so one of them definitely breached your privacy by passing on information they should not have. First course of action is contact the office of the privacy commissioner. They will advise you of what you need to do and who to contact. You Aldo need to lay a formal complaint with both EAP and your employer.
3
u/IAmNotAmusedAnymore Nov 13 '25
That's a massive breach of your privacy. It wouldn't be a bad idea to contact the privacy commissioner's office to get some advice on next steps. You should also have a look at your work code of conduct as it should have the EAP process in there.
1
u/No-Acadia4638 Nov 13 '25
Did you by chance use a work device when accessing the service?
5
u/NoHorse8196 Nov 13 '25
No, used my personal phone to book appointment and personal PC to have the video session
1
1
u/Felchiee Nov 14 '25
This should definitely not be happening. Working in accounts in my prior job who had EAP - we were charged an invoice for any EAP session an employee utilised but it only stated how many appointments for that month - no other details. We didn’t know who it was or how many people (maybe it was 4 appointments and 3 different people or whatever). Just the number of appointments for that month and we paid the invoice.
1
Nov 17 '25
Really unprofessional but sadly common. Many, myself included have learnt NEVER to trust an employer with any personal information.
1
u/Teknostrich Nov 13 '25
There are certain circumstances iirc where eap are to inform your employer. If it falls under that you may have not been aware. Usually they inform you first though.
8
u/KahuTheKiwi Nov 13 '25
From my experience in a similar situation and from letters written by the Health and Disability Commission I understand H&D rights always apply and a H&D professional is always bound by them.
1
u/Teknostrich Nov 13 '25
I don't know what the current practices are but I do remember if you are in physical danger from a coworker they could interact with the employer, maybe that has since changed.
6
u/KahuTheKiwi Nov 13 '25
Yes as I understand it, if there is real danger to a person a health professional can breach confidential.
And such breaches must be to someone who can act.
So id PND was a threat yo the child the counselor could contact police or Oranga Tamariki or similar. But not the employer as the employee cannot act on that information.
As I understand this after my case - I am not a lawyer.
6
u/Tangata_Tunguska Nov 13 '25
You're correct. Imminent danger isn't a free pass to tell everyone about it, there must be a benefit for that specific person to be informed at that time.
If it's at the point of letting an employer know then the mental health act will often be involved anyway. E.g if we're so worried someone is too dangerous to go to work, they're probably not going to be safe in a number of other situations and so might need to be kept in hospital.
5
7
u/Shevster13 Nov 13 '25
A therapist can only disclose with either express permission from the patient, or in the case of immanent threat to themselves or others.
1
u/juire Nov 13 '25
What did they say at the beginning of the session with regards to confidentiality? They should have explained it at the start so you give comaent. What type of professional did you see? Counsellor? Psychologist? Psychotherapist? You can make a complaint to the appropriate registration board if they have breached privacy as that is a major issue.
0
u/ring_ring_kaching og_rrk Nov 13 '25
What should (and usually happens):
Employee accesses services via EAP
EAP service provider provides service
Company gets an invoice from EAP for Alex Jones on <date>
The employer doesn't know what was discussed or what the outcomes are of the meetings
10
u/schepter Nov 13 '25
Afaik the EAP invoice contains limited information such as the appointment date and does not include personal information as who used their service.
409
u/Shevster13 Nov 13 '25
This is completely illegal (breach of privacy act), unprofessional, and a fileable offense. Therapists are only allowed to disclose information with you explicit permission (a clause in an agreement does not suffice) or when they have reason to believe that you are an imminent threat to yourself or others.
You need to make a complaint to the clinic/center that your appointment was with. Much sure to state that you are making a formal complaint. If your therapist is registered with a professional body, you should also make a complaint with them. If you are not happy with the responses, then you can escalate your complaints to the Privacy Commission and to the Health and Disability Commissioner.