Employee assistance programs and your legal obligations as an Australian employer

Australian employers are not legally required to offer staff an employee assistance program (EAP). No statute says you must pay for counselling for your team. But that is not the end of the question. You have legal duties that an EAP can help you meet, and once you run one, a second set of duties attaches to it.

Under work health and safety (WHS) law you must do what is reasonably practicable to protect the psychological as well as the physical health of your workers. That duty now has explicit teeth: most Australian jurisdictions have introduced specific rules about psychosocial hazards, the workplace factors that can cause psychological harm. And if you choose to provide an EAP, the Privacy Act 1988 (Cth) governs how counselling data is handled, who can see it, and what you must do if it is breached.

This guide sets out the three obligations in play: the WHS duty to manage psychosocial risk, the Fair Work context that surrounds employee mental health, and the privacy duties that apply once an EAP exists. It then covers what happens if you get them wrong, a compliance checklist, and where a lawyer actually helps.

Who the duties apply to

The WHS duty applies to every person conducting a business or undertaking, usually shortened to PCBU, which in practice means every employer from a sole trader to a multinational. There is no headcount or turnover threshold. The moment you have workers, the duty exists, and the directors and officers of a company carry their own separate obligations.

The privacy duties apply differently. The Privacy Act covers "organisations" with annual turnover above $3 million, but there is a carve-out that matters for EAPs: a business that provides a health service and holds health information is never treated as a small business, whatever its turnover. Counselling providers fall squarely into that category, which is why an EAP almost always brings the full privacy regime with it, even for a small employer.

Duty one: manage psychosocial risks under WHS law

The starting point is the primary duty of care. Under s 19 of the Work Health and Safety Act 2011 (NSW), a PCBU must ensure, so far as is reasonably practicable, the health and safety of workers and provide and maintain a work environment without risks to health. "Health" includes psychological health, a point the regulators have made emphatically in recent years.

The model WHS laws were amended in 2022 to put the point beyond doubt. In NSW, Division 11 of the Work Health and Safety Regulation 2025 defines a psychosocial hazard as a hazard arising from the design or management of work, the work environment, plant, or workplace interactions and behaviours that may cause psychological harm, whether or not it also causes physical harm. The regulation then requires you to manage psychosocial risks in line with the general risk management process: identify the hazards, assess the risks, put controls in place, and review them. The other states and territories have adopted equivalent rules, mostly based on the same model regulations, so the substance is consistent across the country even if the section numbers differ.

What does that mean in practice? Walk through the recognised psychosocial hazards and ask whether each one is present in your business:

• Job demands: unrealistic deadlines, high workload, long hours, emotionally demanding work
• Job control and support: whether staff have say over how they work and whether managers and peers back them up
• Role clarity: conflicting or unclear responsibilities
• Workplace relationships: bullying, harassment, discrimination, poor conflict handling
• Trauma and violence: exposure to traumatic events, aggression, remote or isolated work

Consultation is a legal requirement, not an option. Under ss 47 and 49 of the WHS Act you must consult workers when identifying hazards, assessing risks and deciding on controls. That means asking your people what is actually causing stress, rather than guessing from a checklist.

For practical guidance, Safe Work Australia's model Code of Practice: Managing psychosocial hazards at work (July 2022) walks through the whole process. A code of practice is not legislation, but it is admissible in court as evidence of what reasonably practicable compliance looks like, so deviating from it without a good reason is a risk.

Where does an EAP fit? It is a legitimate control, particularly for high stress or trauma exposed work, but it is a downstream one. It helps a person who is already struggling. It does nothing about the workload, the toxic behaviour or the role confusion that made them struggle. If your only psychological safety measure is an EAP, you have not discharged the duty.

Duty two: work within the Fair Work framework

There is no separate statutory category of "mental health leave" in Australian employment law. Mental illness is not a distinct leave type, so do not let an EAP marketing brochure suggest otherwise.

Instead, employees who are unfit for work because of illness or injury, which includes mental health conditions, use their paid personal or carer's leave. Under s 96 of the Fair Work Act 2009 (Cth) a non-casual employee accrues 10 days of paid personal or carer's leave for each year of service, progressively through the year, and it accumulates from year to year. Casual employees do not accrue paid personal leave under the National Employment Standards, though they may be entitled to unpaid carer's leave.

The Fair Work system also gives workers direct remedies. A worker who believes they are being bullied at work can apply to the Fair Work Commission for a stop-bullying order, and the Commission can make orders if it is satisfied the bullying risk is real. Reasonable management action carried out in a reasonable way does not count as bullying, so the system is not a weapon against legitimate performance management, but it is a reminder that how you manage people matters as much as what you manage.

An EAP should sit inside this framework rather than beside it. If a manager is told an employee is using the EAP, that information must not leak into performance discussions. The whole point is a confidential space that operates separately from the employment relationship, and the Fair Work and anti-discrimination exposure you face if that boundary is crossed is real.

Duty three: protect privacy if you run an EAP

This is the obligation employers most often get wrong, because they assume the Privacy Act barely touches them. Two features of the Act change that analysis for EAPs.

First, the employee records exemption. Under s 7B(3) of the Privacy Act 1988 (Cth) an employer's handling of an employee record is exempt if it is directly related to the employment relationship. That is why your own personnel file can sit outside the Australian Privacy Principles. But the exemption only covers records held by the employer. The counselling notes, session details and health information generated by an EAP belong to the provider, not to you, and the provider has no exemption at all.

Second, the provider is a health service provider. Under s 6D of the Act, a business that provides a health service to someone and holds their health information is not a small business for privacy purposes, regardless of turnover. Your EAP provider is therefore fully covered by the Australian Privacy Principles even if you, as the small employer, would otherwise be exempt. Health information is sensitive information, so the provider generally needs consent to collect it, can only use and disclose it for the purpose it was collected, and must keep it secure.

The notifiable data breaches scheme in Part IIIC of the Act completes the picture. If there are reasonable grounds to believe an eligible data breach has occurred, meaning unauthorised access, disclosure or loss of personal information that is likely to result in serious harm, the entity must prepare a statement and notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable. A breach of counselling records is precisely the kind of event the scheme was built for.

The practical consequences for how you run an EAP:

• Voluntary and confidential: participation must be voluntary, and the limits of confidentiality, such as risk of serious harm or legal obligations, must be explained before sessions start
• Data minimisation: collect nothing beyond what is needed to administer the program
• De-identified reporting: you should receive aggregate usage data only, such as number of sessions, never session content or identifying detail
• State health laws: some states have their own health records privacy legislation, so check what applies in your state before finalising arrangements

What happens if you get it wrong

The WHS consequences are the heaviest. In NSW, the penalties were substantially increased by the Work Health and Safety Amendment Act 2023 (NSW) and are now indexed annually. Under ss 31 to 33 of the WHS Act, a Category 1 offence (engaging in conduct with gross negligence or recklessness that exposes a person to a risk of death or serious injury or illness) carries up to 90,424 penalty units for a body corporate, which is more than $10 million at current unit values, and up to 10 years imprisonment for an individual. Category 2 offences carry up to 18,128 penalty units for a body corporate, and Category 3 up to 6,070. Failing to manage psychosocial risk can be prosecuted on the same footing as failing to guard a machine, and officers face personal liability for their due diligence failings.

The privacy consequences are different in kind but still serious. The Information Commissioner can investigate, make determinations that require compensation, and seek civil penalties for serious or repeated interferences with privacy. For an EAP, the bigger commercial risk is usually the collapse of trust. Employees will stop using a program they do not believe is confidential, which defeats the purpose, and a breach of counselling data can generate complaints, regulator attention and reputational damage that a small business struggles to absorb.

There is also the broader employment exposure. A worker whose psychological injury was foreseeable can pursue a workers compensation claim, bullying conduct can produce Fair Work Commission orders, and a botched dismissal of someone struggling with their mental health can become an unfair dismissal or discrimination claim. An EAP, properly run, is part of the defence against all of these. An EAP run badly can become evidence against you.

A practical compliance checklist

Work through the following steps in order:

• Document a psychosocial risk assessment that names the hazards in your business and the controls for each one
• Consult workers on the assessment and keep a record of what they told you
• Decide whether an EAP is a proportionate control, and if so, negotiate a provider contract that covers scope, service levels, session limits, credentials and insurance
• Put privacy clauses in the provider agreement: consent for collection, limits on use and disclosure, de-identified reporting, security measures and breach notification
• Adopt a short wellbeing or EAP policy that states eligibility, how to access the program, confidentiality limits and crisis pathways
• Make sure your privacy policy reflects how EAP information is actually handled, including the third party arrangement
• Give managers one page of guidance: how to refer, what they may and may not be told, and how to keep confidentiality
• Keep a tested data breach response plan, because a counselling data breach is a realistic scenario, not a theoretical one
• Track de-identified indicators such as utilisation, absenteeism, turnover and complaints, and feed them back into the risk assessment

Where a lawyer actually helps

A lawyer's value here is mostly in the documents and the judgment calls. Drafting or reviewing the provider agreement is the classic task, because the privacy and breach provisions determine who wears the risk if something goes wrong. A privacy impact assessment for the program is worth doing before launch rather than after a complaint. On the WHS side, a lawyer can help you structure the risk assessment, review policies against the current psychosocial regulations in your state, and advise on what is reasonably practicable for a business of your size and risk profile. If a regulator contacts you, or a serious incident occurs, advice before you respond is usually far cheaper than advice after.

Start with the psychosocial risk assessment

The duty most often missed is not the one about counselling. It is the duty to identify and fix the causes of psychological harm in the first place. An EAP is a control, not a substitute for the risk assessment, and a regulator will look first at whether you did the assessment, consulted your workers and addressed the hazards it revealed, not at whether your EAP brochure is glossy.

The first action to take this week is to run the hazard walk: workload, control, support, role clarity, relationships, trauma exposure. Write down what you found, ask your people whether you got it right, and only then decide whether an EAP is part of the answer. Once it is, align the provider contract and the privacy documents before you announce it. That order, risk first and documents second, is what keeps the program defensible if anything goes wrong.