Employer-sponsored on-site counseling, corporate wellness, and cloud AI scribes: what employment litigation, EEOC investigations, and workers' compensation can reach

The on-site counseling model: how it differs from EAP and why the HIPAA structure creates a conflict

Employee Assistance Programs are administered by third-party vendors — Lyra Health, Spring Health, Magellan, Optum, ComPsych, and their competitors — who contract with employers to provide short-term counseling to employees. The EAP vendor employs or contracts with the therapists. The employer pays the EAP vendor for the service but does not have direct access to session records, and the EAP vendor's contractual confidentiality framework interposes an arm's-length barrier between the employer's HR team and the clinical content of employee sessions. EAP confidentiality is contractual, not absolute — but the contractual structure exists precisely because the employer recognized that employees would not use mental health services they believed the employer could access.

Employer-sponsored on-site counseling is structurally different. In this model, the corporation directly employs the therapist — the therapist's W-2 is issued by the corporation, their benefits come from the corporation, their office is in the corporation's building, and their clients are the corporation's employees. Large technology companies, financial institutions, law firms, and manufacturing operations have built in-house wellness programs that include directly employed licensed therapists and counselors. The appeal is access and stigma reduction: a therapist in the building, available same-day, integrated into the employee wellness and HR ecosystem.

The HIPAA structure in this model is specific and consequential. The therapist, as a licensed health care provider who transmits health information electronically, is a HIPAA covered entity. The corporation, as the therapist's employer, is not itself a covered entity with respect to the clinical sessions — the clinical records are the therapist's records, not the corporation's records, even if they are stored on corporate IT infrastructure. The corporation does not automatically become the therapist's business associate through the employment relationship. However, this clean theoretical separation begins to blur in practice: clinical records may be stored on corporate servers, session audio may be transmitted over the corporate network, and the employer's legitimate IT administration rights may reach both.

The fundamental conflict is structural: the employer has a direct financial and legal interest in knowing what its employees disclose in therapy. Harassment complaints, disability disclosures, substance use admissions, descriptions of workplace misconduct, and accounts of supervisory retaliation are precisely the disclosures that affect the employer's legal exposure in employment litigation — and precisely the disclosures that employees make in therapy sessions with the on-site counselor. A cloud AI scribe that independently retains verbatim session audio does not just create a data management problem; it creates an independently accessible archive of the employer's most legally sensitive employee disclosures, held by a third-party vendor that neither the employer nor the therapist fully controls.

What corporate wellness sessions capture — and why the gap with the formal note is structurally wide

Corporate on-site therapy sessions are not generic outpatient psychotherapy. The presenting concerns are shaped by the work context: occupational stress, burnout, interpersonal conflict with named supervisors and colleagues, perceived retaliation or harassment, accommodation needs related to disability or medical conditions, financial stress tied to compensation or job security, and the psychological impact of specific workplace incidents. Clients disclose these concerns in detail — naming their manager, describing specific incidents with dates and locations, identifying colleagues involved, and recounting the exact words used in confrontations that constitute their discrimination or harassment claims.

The therapist's formal clinical note for a corporate wellness session typically documents the presenting concern in clinical terms: "client reports work-related stress; primary stressors include interpersonal conflict with supervisor and concerns about job performance evaluation." The note does not reproduce the client's verbatim account of what the supervisor said in the meeting, the names of other employees who witnessed the incident, or the dates and specific circumstances of the conduct the client describes as retaliatory. A cloud AI scribe captures all of it — the specific names, the verbatim incident accounts, the dates, the descriptions of who was present and what was said.

The gap between the formal clinical note and the vendor's verbatim archive is structurally wide in corporate on-site practice because the most legally sensitive content of a session — the specific factual allegations that would constitute a discrimination or harassment claim — is also the content the therapist most deliberately omits from the formal note. Therapists in on-site settings typically understand that their formal records may be subject to employer access requests, subpoenas in employment litigation, or licensing board review, and they note-take accordingly: clinical synthesis, not verbatim factual recitation. The vendor's archive does not apply that clinical judgment. It holds what the client actually said, in the words they used, about the specific workplace conduct they are describing.

Five adversarial proceedings that reach the vendor archive in corporate on-site settings

1. EEOC administrative investigation and Title VII discrimination claims

The Equal Employment Opportunity Commission has broad administrative investigative authority under Title VII, the ADA, ADEA, and the Pregnancy Discrimination Act. In investigating an employee's discrimination charge, EEOC investigators can issue civil investigative demands and administrative subpoenas to third-party record custodians — including cloud AI scribe vendors — without the employer's or the therapist's involvement. An EEOC investigator pursuing a charge of hostile work environment, sexual harassment, race discrimination, or disability discrimination by a supervisor named in an on-site therapy session can seek the vendor's verbatim archive of sessions in which the charging party described the discriminatory conduct.

EEOC investigation is particularly consequential in the on-site counseling context because the employer is the respondent in the same proceeding. The EEOC may seek the vendor archive both to corroborate the charging party's account and to evaluate whether the therapist's records — and the employer's knowledge of the employee's disclosures — bear on the employer's affirmative defense under Faragher and Ellerth (the defense that the employer had adequate anti-harassment policies and the employee unreasonably failed to use them). If the session archive shows the employee disclosed harassment to the on-site therapist — an employee of the company — the employer's Faragher-Ellerth defense is significantly weakened, because the employer had constructive or actual knowledge of the harassment through its own employed counselor.

2. Wrongful termination and retaliation litigation

When a corporate employee is terminated and brings a wrongful termination or retaliation claim, the litigation discovery process creates multiple pathways to the on-site counseling records. The plaintiff's attorney will seek any records of the employee's mental health treatment during the employment period, particularly records created contemporaneously with the events giving rise to the retaliation claim. A corporate wellness session in which the employee described their supervisor's retaliatory conduct — contemporaneously, in the employee's own words, before any litigation strategy was developed — is the most probative available evidence about the employee's experience of retaliation.

The plaintiff's attorney reaches the cloud AI scribe vendor directly through a Rule 45 subpoena. The vendor's legal team evaluates whether a valid HIPAA exception applies — typically the judicial proceeding exception under 45 CFR 164.512(e), which permits disclosure in response to a court order or a qualified protective order — and produces the responsive records. Civil subpoena authority reaches the vendor as a third-party custodian without going through the therapist and without requiring the therapist's cooperation. The vendor produces records it holds; the therapist learns about the subpoena when the records surface in discovery.

The employer's defense counsel has equal access. If the terminated employee's therapy sessions include disclosures about prior mental health conditions, substance use, or personal circumstances that the defense can use to contest the damages theory or the causation analysis, the employer's attorneys will seek the same vendor archive through their own Rule 45 subpoena. Both sides can seek the vendor's records independently, each developing their own litigation strategy around verbatim session content the therapist never intended to be the evidentiary record.

3. Workers' compensation mental health claims

Employees who develop anxiety, depression, or PTSD attributable to workplace conditions may file workers' compensation mental health claims against the employer. In states that recognize occupational mental health claims — California, New York, New Jersey, and others — the employer's workers' compensation insurer has a direct financial interest in limiting the compensable injury. On-site counseling sessions from the period of the claimed psychological injury are directly probative: they represent contemporaneous, professionally documented evidence of the employee's mental health status, the precipitating workplace conditions, and the functional impairment that forms the basis of the claim.

Workers' compensation proceedings have discovery mechanisms that reach third-party record custodians. The employer's insurer, through its defense attorney, can issue subpoenas to the cloud AI scribe vendor in the workers' comp proceeding to obtain the verbatim session archive. The insurer is seeking content that the formal clinical note may characterize in general terms but the vendor's archive preserves in specific detail: the exact workplace conditions the employee described as causing their psychological injury, the severity of symptoms as the employee verbally described them session by session, and any disclosures about pre-existing mental health conditions or non-occupational stressors that the insurer can use to argue that the claimed injury is not attributable to the workplace.

The on-site counseling context creates a particular tension in workers' compensation: the employer is the insured party who benefits from limiting the claim, and the therapist is the employer's employee. The therapist's formal clinical records may be subject to pressure — implicit or explicit — to document in ways that serve the employer's interest in limiting workers' comp liability. The vendor's verbatim archive, which the employer cannot control, becomes the more neutral evidentiary record — and the one both sides want access to.

4. ADA disability accommodation disputes and FMLA litigation

Employees who seek disability accommodations under the ADA or Family and Medical Leave Act protection for a mental health condition often initiate that process through the on-site wellness counselor — who is both their therapist and the employer's employee. The counselor may be the first clinical contact who documents the employee's disability, the functional limitations it creates, and the accommodation the employee is requesting. When the employer subsequently denies the accommodation or terminates the employee, the ADA or FMLA litigation discovery seeks the records of those initial disclosures.

The cloud AI scribe vendor's archive of sessions in which the employee disclosed their disability, described their functional limitations, and discussed the accommodations they needed is directly probative on the central questions in ADA litigation: what was the nature of the disability, what accommodations would have been effective, and what did the employer know and when. Disability proceedings broadly reach therapy records, and a vendor archive of on-site counseling sessions is reachable by the plaintiff's attorney, the employer's defense counsel, and the EEOC through the same Rule 45 mechanism that reaches any third-party record custodian.

The ADA reasonable accommodation interactive process is supposed to be a good-faith dialogue between the employer and the employee about the nature of the disability and the available accommodations. When the employer's own employed therapist is the clinical source who documented the initial disability disclosure, and a cloud AI scribe holds the verbatim session audio of that disclosure, the vendor's archive becomes the most complete available record of what the employee said, what they asked for, and what the therapist knew and communicated — all in the employer's own employment ecosystem.

5. Grand jury subpoena and criminal investigation of corporate misconduct

Corporate employees who learn of financial fraud, securities violations, workplace safety violations, or other criminal conduct at their employer may disclose that knowledge in on-site counseling sessions. The psychological burden of witnessing or being pressured to participate in corporate misconduct is a legitimate therapy concern — and the employee's description of the misconduct in a therapy session is a contemporaneous factual account created before any litigation strategy was developed.

Federal grand jury subpoena authority reaches any third-party record custodian, including cloud AI scribe vendors, without limitation by HIPAA or the therapist's covered entity status. A grand jury investigating corporate fraud, securities violations, or workplace safety crimes can issue a subpoena to the vendor for session audio in which the employee described the conduct under investigation. The vendor must comply with a valid grand jury subpoena; the HIPAA grand jury exception at 45 CFR 164.512(f)(1)(ii) explicitly authorizes business associates to respond to grand jury subpoenas. The therapist is not notified of the grand jury proceeding and may not learn that the vendor's records were subpoenaed until the employee's disclosures surface in a federal criminal prosecution.

The irony in the corporate on-site context is pointed: the employee disclosed corporate misconduct to the employer's own therapist — someone on the company's payroll — and the vendor's independently retained archive of that disclosure is then accessible to federal investigators through the grand jury process, without the employer's or the therapist's involvement, and potentially to the very corporate management whose misconduct the employee described.

The corporate network problem: when session audio travels over employer infrastructure

Cloud AI scribes transmit session audio to vendor servers for processing. In a corporate on-site counseling setting, that transmission travels over the network that the corporation owns and administers. Corporations retain broad IT monitoring rights under their acceptable use policies and applicable law. Network traffic analysis, deep packet inspection, and IT administrative monitoring are standard corporate network security practices — and they apply to all traffic on the corporate network, including audio data transmitted by a cloud AI scribe vendor.

HIPAA governs what the therapist, as the covered entity, can disclose and to whom. It does not govern what the employer's IT department can access in the course of legitimate network administration. If the corporate network's traffic monitoring captures audio data in transit to a cloud AI scribe vendor's servers, that capture may fall entirely outside HIPAA's disclosure framework — because it is the employer's own IT infrastructure accessing data on the employer's own network, not the therapist disclosing PHI to an unauthorized recipient.

This is not a theoretical risk. Corporate network traffic is routinely logged, analyzed for security events, and retained for periods that may extend years beyond the employment relationship. An employee's session audio, transmitted in cleartext or in encrypted form that the corporate network's SSL inspection infrastructure decrypts, may be retained in corporate network logs long after both the employee and the therapist have left the company.

The solution is not to use a stronger HIPAA BAA with the cloud AI scribe vendor — a BAA governs what the vendor does with data, not what the corporate network captures in transit. The only architectural solution is to keep session audio off the corporate network entirely.

On-device processing and the corporate on-site counseling context

TherapyDraft processes every session on the therapist's Mac — locally. Session audio is captured by the device's microphone, transcribed by whisper.cpp running on Apple Silicon, and the draft note is generated by a local language model. No audio leaves the device. No transmission crosses the corporate network. No cloud AI scribe vendor independently retains a verbatim archive of the session.

In an EEOC investigation, there is no cloud AI scribe vendor to subpoena. In wrongful termination litigation, neither the plaintiff's attorney nor the employer's defense counsel has a vendor archive of verbatim session content to seek. In a workers' compensation proceeding, the employer's insurer cannot reach a vendor's independently retained archive of the employee's injury disclosures. In an ADA accommodation dispute, the interactive process documentation exists in the therapist's clinical records — which the therapist controls as the HIPAA covered entity — not in an independently accessible vendor archive. In a grand jury investigation, the vendor does not exist to subpoena.

The formal clinical note — authored by the therapist, with clinical synthesis and appropriate omission of non-clinical factual content — is the documentation record. The employee's verbatim description of their supervisor's conduct, the specific dates of incidents, the names of colleagues who witnessed workplace events, and the precise account of the disability or harassment experience the employee disclosed in session never reaches any third-party custodian. The therapist's deliberate documentation choices — what to include in the clinical record and what to omit from it — are not overridden by a vendor's independent data retention policy.

For therapists working in corporate on-site settings, the architectural guarantee is not primarily a HIPAA compliance feature. It is a resolution of the structural conflict that the EAP model addresses through vendor arm's-length separation and that on-site employment makes unavoidable: when the employer is also your employer, the only way to ensure that your clients' workplace disclosures remain in your clinical control is to ensure those disclosures never leave your device.

Frequently asked questions