Employee Mental Health Screening: What Employers Can and Can't Do
In this article
Every few months someone in an HR group I belong to asks a version of the same question: can we just have everyone take a depression screener and see where we stand? The instinct is a good one. You want to know whether people are struggling before it shows up in turnover and absence numbers. But the moment an employer starts collecting information about an individual's mental health, a set of federal rules switches on, and most of them exist precisely to keep that information away from the people who make employment decisions.
This piece walks through those rules at a general level. It is not legal advice. Federal law in this area is detailed, state law adds its own layers, and parts of the EEOC's wellness-program rules have been unsettled for years. Use it to frame the conversation, then take your plan to employment counsel before anything goes live.
Two different things that get called "screening"
Half the confusion comes from one word covering two very different activities.
Organizational assessment looks at the workplace. Are policies clear? Do managers know where to send someone? Is the EAP visible? Do people feel safe raising workload concerns? Tools like our workplace mental health self-check sit here: it asks about the organization's practices across four areas, not about anyone's symptoms. So does a climate survey about stressors, workload and trust, provided it doesn't ask people to report diagnoses, treatment or symptoms.
Individual screening looks at a person. Validated instruments such as the PHQ-9 for depression or the GAD-7 for anxiety ask about symptoms over the past two weeks and produce a score that suggests whether someone should talk to a clinician. That is health information about an identifiable individual, and when the employer is the one asking, it is very likely a disability-related inquiry or medical examination under the Americans with Disabilities Act.
Most of this article is about the second category. If you actually need the first, design for it from the start and you avoid most of the legal risk. The step-by-step version of that is in how to run a workplace mental health assessment.
The federal rules, in brief
The ADA limits what you can ask current employees
Title I of the ADA covers employers with 15 or more employees. For people already on the payroll, an employer may make disability-related inquiries or require medical examinations only when they are job-related and consistent with business necessity. In practice that usually means you have objective evidence that a particular employee can't perform essential job functions, or poses a direct threat, because of a medical condition. That is the territory of a fitness-for-duty evaluation, not a workforce survey.
A blanket mental health screen of the whole workforce doesn't meet that standard. There is no business necessity in knowing that the accounts payable team scores, on average, in the mild range for anxiety.
The statute does carve out one path: voluntary medical examinations and inquiries that are part of an employee health program. That carve-out is where wellness programs, health risk assessments and most employer-sponsored screening live, and the word "voluntary" carries nearly all the weight.
Confidentiality is not optional
Whatever medical information an employer obtains through a lawful inquiry or exam, the ADA requires it to be kept confidential. It goes in a separate medical file, not the personnel file, and access is limited. Supervisors may be told about work restrictions and accommodations. First aid and safety staff may be told if someone might need emergency treatment. Government officials investigating compliance can see it. That is close to the full list.
Two points HR teams often miss. First, the confidentiality rule protects everyone's medical information, not only people who turn out to have a disability. Second, information doesn't have to arrive through a formal form to deserve protection. EEOC guidance treats medical details an employee volunteers, or that a manager learns while handling an accommodation request, as confidential as well. The safe habit is to treat any health information a manager hears as confidential and to route it to HR.
What "voluntary" means to the EEOC
Under the EEOC's wellness regulations, a program that includes disability-related inquiries or medical exams has to be genuinely voluntary. In broad terms, that means the employer:
- doesn't require anyone to participate;
- doesn't deny anyone health coverage or a particular benefits package, or limit their coverage, because they decline;
- doesn't take adverse action against, retaliate against, interfere with, coerce, intimidate or threaten anyone over whether they take part.
The regulations also require the program to be reasonably designed to promote health or prevent disease. Collecting screening data without giving participants their results or any follow-up, or using the data mainly to shift costs onto employees, fails that test. And the employer must give participants a notice that explains what information will be collected, who will receive it, how it will be used and how it will be kept confidential.
Then there is the incentive question. The EEOC's 2016 rules allowed incentives of up to 30 percent of the cost of self-only coverage. A federal court vacated those incentive limits, effective at the start of 2019, and replacement rules the EEOC proposed in January 2021 were withdrawn weeks later. At the time of writing there is no settled federal answer on how large a reward can be before a program stops being voluntary. The cautious reading, and the one I would follow, is to keep any incentive for mental health screening small or to skip it entirely.
Aggregate-only reporting
The same regulations say an employer may receive information collected through a wellness program only in aggregate form that doesn't disclose, and isn't reasonably likely to disclose, the identity of specific individuals, except where needed to administer a health plan. The "reasonably likely" clause matters for small groups. If a report breaks results out for a five-person night shift, the numbers can identify people even without names attached. Good vendors suppress any result for a group below a minimum size. Ask what theirs is and get it in writing.
GINA and family history
The Genetic Information Nondiscrimination Act treats family medical history as genetic information. A screener that asks whether anyone in your family has been treated for depression or bipolar disorder is collecting it. GINA's wellness rules come with their own consent conditions, and the simplest approach for an employer-sponsored tool is to leave family history questions out altogether.
Where HIPAA does and doesn't apply
HIPAA's privacy rule governs health plans, healthcare providers and clearinghouses, not employers acting as employers. If screening is offered through your group health plan or by a provider, HIPAA protects that data and limits what flows back to you as plan sponsor. If HR runs a screener itself, HIPAA probably doesn't apply, but the ADA confidentiality rules still do. Neither law lets you sidestep the other.
States add their own requirements. California's Confidentiality of Medical Information Act, for example, has provisions aimed specifically at employers. Check every state where you have staff.
Can and can't, side by side
| Usually fine, with care | Usually a problem |
|---|---|
| Anonymous organizational surveys about workload, culture and support | Requiring employees to complete a depression or anxiety screener |
| Linking to free, anonymous online self-screens where the employer receives no individual data | HR or managers seeing individual screening scores |
| Voluntary screening through the health plan, EAP or a vendor, with aggregate-only reports | Reports broken down by small teams where people could be identified |
| Giving participants their own results and a clear route to care | Screening with no feedback, referral or follow-up |
| Modest participation-based recognition, after counsel's review | Large rewards or penalties tied to completing a screener |
| A fitness-for-duty evaluation for a specific employee, based on objective evidence | Asking about family history of mental illness |
| Keeping medical information in a separate, restricted file | Storing screening results in the personnel file or a shared drive |
Treat it as a starting point: how a program is built still decides the answer.
A worked scenario
Picture a hypothetical 220-person credit union in Pennsylvania. After a rough year with two branch consolidations, the CHRO wants a read on how staff are doing. Her first draft is a PHQ-9 sent through the HR information system, with results going to HR "so we can reach out to anyone who scores high."
Counsel flags three problems. Logging in through the HRIS ties every response to a name. HR would see individual scores. And reaching out to high scorers means HR is acting on medical information about identified employees, which is exactly what the confidentiality rules are built to prevent.
The revised plan splits the work. The organizational question goes to an anonymous climate survey run by an outside vendor. It asks about workload, manager support and awareness of the EAP, with a minimum reporting group of ten. The individual question goes to the EAP, which offers a voluntary, confidential screening tool. Each participant sees their own result immediately, along with the EAP's phone line, how to find an in-network therapist and the 988 Suicide & Crisis Lifeline, which anyone in the US can reach by calling or texting 988. The credit union receives one quarterly report: the number of screens completed and the share scoring above the referral threshold, organization-wide only. No incentive is attached.
The CHRO gets less than she asked for. She also gets a usable picture, a lower-risk program and more participation, because staff believe the "confidential" label.
Building it so people trust it
The law sets a floor. Participation depends on whether employees believe nobody at work will see their answers. A few practices help:
- Use a third party. Screening run by the EAP, the health plan or an independent vendor reads as more private than anything inside the HRIS.
- Say exactly what the employer receives. "We will see the total number of people who took the screen, and nothing else" lands far better than "results are confidential."
- Always pair a score with a next step. Every results page should say where to go: the EAP, plan providers and, for anyone in crisis, 988. The access to care section of the four key areas has recommended actions for making that route visible.
- Keep managers out of it. Managers shouldn't track completion rates by team, and shouldn't ask anyone whether they took part.
- Write the rules down. Your mental health policy should state that individual health information never reaches supervisors, and should name who holds it.
If you need neutral starting points, our resources library collects free guidance and tools. The EEOC's plain-language explainer on mental health conditions in the workplace is written for employees, which makes it a useful check on how your program will look from their side.
Frequently asked questions
We have 12 employees. Does any of this apply?
The ADA's employment provisions start at 15 employees, but many state disability laws reach smaller employers, and the trust problem doesn't shrink with headcount. In a small business, aggregate data identifies people even faster. Assume the same care is needed.
Can a manager ask an employee if they're okay?
Yes. A general, caring question about how someone is doing isn't a medical inquiry. Asking whether they have depression, what medication they take or whether they're seeing a therapist is different, and managers should steer clear of it.
Is an anonymous screener risk-free?
Closer to it, if it is truly anonymous: no logins tied to identity, no IP or device data handed back to the employer, no small-group breakouts. Check the vendor's data practices rather than relying on the word "anonymous."
What if a screening result suggests someone is in danger?
That is one reason individual results should go to the participant and to a clinical service, not to HR. A well-designed tool shows crisis resources on the results page and, when run by a clinical provider, follows that provider's own safety protocols.
Do we need written consent?
For a program covered by the EEOC's wellness rules, you need the notice described above, and GINA has its own authorization requirements wherever genetic information is involved. Counsel can tell you what form it should take.
