# How can therapists report to employers on EAP work without breaking confidentiality?

URL: https://tymirahealth.com/resources/faqs/how-can-therapists-report-to-employers-without-breaking-confidentiality
For: Executives | Data protection and privacy | Last reviewed 8 November 2026

**Answer:** Share only aggregated, de-identified trends, such as the number of sessions, broad reasons for contact and average outcome changes, never names or session content. Agree the report contents with the employer in the contract and tell clients what will and will not be shared. Suppress small groups, for example any figure based on fewer than five people, because small numbers in a small team can still identify someone.

### Why EAP reporting is tricky

Employers want to know whether their programme is used and helping. Clients need to trust that nothing they say reaches their manager. Practitioners tell us every report takes careful, manual de-identification.

Health data is sensitive personal data under Kenya's Data Protection Act 2019, so de-identification is a legal duty, not just good practice.

- Agree report fields in writing before the programme starts.
- Report counts, ranges and themes, never individual records.
- Hide or merge any group smaller than an agreed threshold.
- Remove dates, roles or locations that could point to one person.
- Have a second person check each report before it is sent.

Read more: [Role-based access for therapy notes and mental health records](https://tymirahealth.com/resources/blog/role-based-access-for-therapy-notes-and-mental-health-records)

## More questions

### Can an employer ask to see an employee's therapy notes?

No, not without the client's informed consent or a lawful basis such as a court order. Tell employers this clearly at the start of the contract.

### Can de-identified reports still identify someone?

Yes, in small teams or when several details are combined. That is why small numbers should be suppressed and reports reviewed before sending.

## Related reading

- [Role-Based Access for Therapy Notes and Mental Health Records](https://tymirahealth.com/resources/blog/role-based-access-for-therapy-notes-and-mental-health-records)

## Related questions

- [Can clinics in Kenya store patient data on cloud servers outside Kenya?](https://tymirahealth.com/resources/faqs/can-clinics-store-patient-data-outside-kenya)
- [Can employers screen staff for mental health conditions?](https://tymirahealth.com/resources/faqs/can-employers-screen-staff-for-mental-health-conditions)
- [Does a clinic need to register with the ODPC?](https://tymirahealth.com/resources/faqs/does-a-clinic-need-to-register-with-the-odpc)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all