Written By Elijah Fernandez, MSW, PMP, CISSP
Compliance officers spend their working lives thinking about records: who creates them, who can see them and how long they last. The same habit can keep them from getting help when the job starts to wear them down. In about 20 years in healthcare IT, including time as director of IT operations at a national mental health company, I have watched how a claim, a diagnosis code or a referral moves through an organization.
Compliance staff know that path better than almost anyone, and knowing it can make a first call to a therapist feel riskier than it is.
Why compliance work wears people down differently
Compliance roles combine sole accountability with constant vigilance. Many compliance officers work alone or in very small teams, answer for everyone else's adherence and are often the person who has to say no. The work rarely ends cleanly: an audit closes and the next one opens. Over time, that load can produce the three features the World Health Organization uses to describe burnout in its International Classification of Diseases: exhaustion, growing mental distance or cynicism about the job, and reduced professional efficacy.
In compliance, burnout rarely looks like slacking off. It tends to look like more work:
- Over-checking work that is already correct, or rereading the same policy section several times before signing off.
- Trouble closing issues, so investigations and corrective action plans stay open longer than they need to.
- Sleep that breaks at 3 a.m. with a running list of open items.
- Cynicism about the program itself, the quiet sense that nothing the compliance team does will matter.
Any one of these can be ordinary. Several together, for weeks at a time, deserve the same attention a compliance officer would give a repeat audit finding.
The records question: what HIPAA does and does not protect
The HIPAA Privacy Rule governs how covered entities, meaning health plans, health care providers and clearinghouses, use and disclose protected health information. It does not reach every record an employer holds. The U.S. Department of Health and Human Services states that "the Privacy Rule does not protect your employment records, even if the information in those records is health-related" (HHS, Employers and Health Information in the Workplace). The same guidance notes that an employer can ask for a doctor's note, but a provider cannot give the employer health information without the patient's authorization.
When an employer sponsors a group health plan, the plan documents must provide that the sponsor will "not use or disclose the information for employment-related actions and decisions" (45 CFR 164.504(f)).
In a self-funded plan, maintaining that firewall is often part of the compliance officer's own job, so knowing how well it holds where you work is part of an honest assessment of your own risk.
Psychotherapy notes carry extra protection. Under 45 CFR 164.508(a)(2), a covered entity generally must obtain the patient's authorization before using or disclosing psychotherapy notes, with narrow exceptions. Those are a therapist's separately kept session notes. The claim, the diagnosis code and the dates of service are not psychotherapy notes, and they travel with billing. Employee assistance programs vary, so ask the vendor in writing exactly what it reports to the employer and at what level of detail. The contract, not an assumption, is the answer.
The physician parallel
Fear of a record delays care, and research on physicians shows how much. In a national sample of 5,829 physicians, nearly 40 percent said they would be reluctant to seek formal care for a mental health condition because of concerns about repercussions to their medical licensure, and reluctance was higher in states whose licensing applications asked about more than current impairment (Dyrbye and colleagues, Mayo Clinic Proceedings, 2017). CEREVITY's 2026 white paper, State of Physician Wellbeing, reviews that study alongside related research.
The lesson for compliance and HR is direct: when forms ask about past treatment rather than current impairment, people wait. Reviewing credentialing questions, attestations and leave forms for that difference is squarely within a compliance officer's reach.
Practical steps for compliance officers and leadership
1. Put confidentiality in writing. Give staff a plain-language statement of what the organization can and cannot see when an employee uses the health plan or the employee assistance program.
2. Set boundaries on after-hours escalation. Define what truly needs a call at night and route everything else to the next business day.
3. Build a peer link outside the building. A trusted compliance colleague at another organization can hear what you cannot say internally.
4. Choose care that fits your privacy needs. Some professionals prefer telehealth, a clinician outside their professional circle, or paying privately so that no claim reaches the employer's plan. None of these is required.
5. Know the crisis line. Anyone in crisis can call or text 988 to reach the 988 Suicide and Crisis Lifeline.
Conclusion
Compliance officers protect everyone else's records. They deserve the same clear thinking about their own. Knowing what the Privacy Rule covers, where its limits are and which questions to ask turns a vague fear into a manageable risk, and managing risk is work compliance professionals already do well.
About the Author
Elijah Fernandez, MSW, PMP, CISSP, is co-founder and chief technology officer of CEREVITY Health, Inc. CEREVITY is a private-pay concierge network of independent licensed clinicians built for high achievers: executives, founders, physicians, attorneys and finance leaders. He has spent about 20 years in healthcare IT, including as director of IT operations at a national mental health company, and built CEREVITY's technology himself. He holds a Master of Social Work from the University of Southern California. Learn more at cerevity.com
Additional Resources
- Dyrbye, L. N., West, C. P., Sinsky, C. A., Goeders, L. E., Satele, D. V., and Shanafelt, T. D. (2017). Medical licensure questions and physician reluctance to seek care for mental health conditions. Mayo Clinic Proceedings, 92(10), 1486-1493. https://doi.org/10.1016/j.mayocp.2017.06.020
- World Health Organization. (2019). Burn-out an "occupational phenomenon": International Classification of Diseases. who.int news release
- CEREVITY Health, Inc. (2026). State of Physician Wellbeing (white paper).
- CEREVITY Health, Inc. When therapy records can be subpoenaed
Copyright © 2026 American Institute of Healthcare Compliance All Rights Reserved