Legal Lines

Frequently Asked Questions – and a Few Ready Answers

By Sandra G. Nye, J.D., MSW

EAPA staff tell me that they receive legal questions “all the time,” and would like to have some answers for a change. The questions are very good ones, but the topics are actually quite complex. I’m working on a re-write of my original EAP law book, and I am astounded at the number of changes in the field.  

Each of the 50 states has its own constitution, legislation, and rules. State laws are passed by its legislatures and operate under the statutes and rules enacted. Federal law is enacted by the Congress. When a legal problem arises as to violation or interpretation of Federal law, the matter is handled by the Federal court located in the relevant state jurisdiction.

If a problem arises among individuals, businesses, the so-called “private sector,” the law provides a forum for investigation, access to the courts for trial to determine the facts, who (if anyone) committed a legal wrong entitling the government to impose a punishment, or that the case should be dismissed.
In short, the answer depends upon the site of the parties in the case, and the wrong alleged to have been committed by the defendant against the plaintiff.

Three questions are proposed for discussion in this column:

1. How long should we keep EAP records?

Federal and state laws both apply to the confidentiality of patients’ health, mental health, and substance abuse records. For example, the Federal Electronic Code of Alcohol and Drug Abuse Patient Records, Title 42: Public Health - Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records sets out the law in detail.
Professional associations develop and publish codes and regulations with which their members must comply. Violation of the law can result in severe and expensive sanctions to the professional.

These become part of the law of the profession. To protect both clients and professionals, this material is found online, in professional publications, and in books. It is generally available to the public, scholars, professional providers, and their clients.

The EAPA Code of Ethics provides guidance for EA professionals for the benefit of EAP and its clients. It applies to all EA professionals, their activities and relationships with employees, employers, unions, professional colleagues, the community, and society in general. State statutes offer directives for the retention of clinical records – sometimes included in laws relating to specific professions and/or health laws in general. The rules of professional associations direct members’ conduct and are likely to set out requirements for recordkeeping and maintenance.

The CEAP Code of Conduct requires that CEAPs affirm their commitment to the Code of Conduct. The HIPAA Omnibus final rule requires that a practice disclose a potential breach of privacy unless a low risk of protected health information (PHI) exposure can be demonstrated. A four-year period for retention of records is common. The bottom line is that every professional is governed by his or her governing statutes and organizational rules. 

The nature of the legal relationship between the professional service provider and the client is governed by a contract. Failure of either party to comply with the rights and responsibilities can result in a lawsuit, complaint to governing agencies, and exclusion from further professional participation.

The Health Insurance Portability and Accountability Act (HIPAA) establishes rights of new clients with which practices must comply. For instance, clients have the right to request electronic copies of their clinical records, if the practice retains the copies in that format. If the records are not maintained in a readily reproducible format, the practice must work with the client to agree upon a suitable alternative. In the event that a mode cannot be agreed upon, the practice must provide the records in a readable hard copy. A client who pays the practice in full, out of pocket, for a particular service or test, has the right to ask that no copy of the record be sent to his/her insurer or others.

A thorough search for legal requirements will be shaped by the jurisdictions of the provider and the client. It will include review of federal and state statutes and regulations, material produced by the profession, and relevant litigation claims and outcomes. This is obviously complex, and the search and interpretation requires a high level of legal expertise. IMHO, a lawyer with training and experience in these legal aspects is essential. 

2. An internal EAP at the Acme Company is being laid off and being replaced by a hired external EAP vendor. Acme is demanding that the existing EAP turn over EAP case records to the new vendor. Is Acme allowed to do this?

3. Same as above, but Acme hasn’t selected a new vendor yet and wants the records turned over to the Human Relations Chief.

The relationship between the EAP and clients is set by state law, federal law, and the contractual arrangement between the individual client and the EAP. As stated, the relationship is established according to statute and regulations along with the arrangements to which the client and EAP have agreed. Records must be kept to provide best care to clients, as well as confidentiality and continuity of service required by statutes and rules. The length of time records must be kept is determined by the law of the relevant jurisdiction and varies significantly. The requirements of the profession are highly relevant. Records are required to be kept ranges anywhere from three years up to ten years. 

It is a very good idea to have the EAP counselor and new clients execute (sign) a Statement of Client Understanding, which sets out a description of the provider/client relationship and the rules and understanding between the provider and the client. (See 77 Fed. Reg. 5570, Feb. 3, 2012). This is a contract between provider and client and sets out rights and responsibilities for each party. If no such Statement of Understanding has been executed, statutes and other legal resources must be consulted to determine the rights and responsibilities of the treatment provider and the client.

The bottom line is this: An attorney familiar with privacy, confidentiality, and the legal, organizational, and professional requirements of federal, local and state demands is necessary to handle such matters. 

Sandra Nye is the author of the popular “Employee Assistance Law Book.” She may reached at