HR leaders need to know whether an Employee Assistance Program (EAP) is reaching employees and supporting the organisation’s wellbeing strategy. Employees, however, need confidence that using counselling will not expose their personal concerns to their employer.
These needs are not incompatible. A useful EAP report describes the programme at an aggregate level without turning counselling records into management information. The purpose is to improve awareness, access and workplace prevention—not to identify who sought help or monitor individual behaviour.
Start by separating three types of information
1. Individual clinical information
This may include what an employee discusses in counselling, assessment responses, clinical impressions, appointment notes and personal circumstances. It should not appear in ordinary management reporting.
2. Operational programme information
This describes how the service is functioning, such as appointment availability, broad access channels, awareness activities and aggregate utilisation. HR may need this information to manage the contract and remove barriers.
3. Organisational wellbeing information
This may include anonymised patterns across a sufficiently large population—for example, broad themes related to workload, relationships or change. These patterns can inform prevention, but they should not be treated as diagnoses or used to identify teams or individuals.
What HR can reasonably measure
A proportionate EAP dashboard may include:
- the number or rate of employees accessing the service;
- awareness activity reach, such as briefing or workshop participation;
- the broad route of access, such as self-referral or manager signposting;
- appointment availability and time to the first scheduled session;
- aggregate service format, such as in-person or remote sessions;
- broad, non-identifying themes where the group is large enough;
- anonymous satisfaction or usefulness feedback;
- recommended organisational actions arising from repeated patterns.
Every metric should answer a management question. If HR cannot explain how a data point will improve access, quality or prevention, it may not need to be collected.
What should stay out of the report
Ordinary EAP reports should not include:
- employee names, identification numbers or contact details;
- counselling notes or quotations from sessions;
- diagnoses, medication information or detailed personal histories;
- exact dates and circumstances that make a person identifiable;
- small-team breakdowns that allow managers to infer who attended;
- a list of employees referred by a particular manager;
- individual attendance or progress information for performance management.
Removing a name is not always enough. A description such as “the only night supervisor in Branch A” can still identify a person. HR and the provider should consider the whole context, including team size, location, role and timing.
Use a small-group suppression rule
Before reporting begins, agree on a minimum group size below which data will not be displayed or will be combined with a larger group. The appropriate threshold depends on the workforce and the sensitivity of the information; it should be set with privacy, legal and professional input rather than improvised after a difficult case appears.
Apply the rule consistently. Senior leaders should not receive additional detail simply because they are curious about a particular team.
Do not confuse utilisation with need
A low utilisation rate does not prove that employees are well. It may indicate limited awareness, inconvenient access, language barriers, stigma or concern about confidentiality. Conversely, higher use does not automatically mean the workplace is becoming less healthy; it may mean employees trust the service and seek help earlier.
Interpret EAP data alongside other organisational indicators, such as:
- employee feedback about workload, role clarity and manager support;
- absence, turnover, overtime and incident patterns;
- participation in wellbeing briefings and workshops;
- psychosocial-risk assessment findings;
- changes in work design, restructuring or staffing.
MY Psychology’s PRisMA 2024 and EAP guide explains how programme information can contribute to broader psychosocial-risk management without replacing organisational assessment.
A practical quarterly reporting structure
1. Programme reach
Summarise eligible population, awareness activities and aggregate access. Note important changes such as a new location, language option or communication campaign.
2. Access and service delivery
Report whether employees could obtain scheduled support within the agreed service model. Highlight recurring barriers such as shift coverage, supervisor approval or limited private spaces.
3. Aggregate themes
Present only broad, sufficiently grouped themes. Avoid percentages that create a false impression of precision when the underlying number is small.
4. Organisational recommendations
Convert the data into actions. For example: repeat the confidentiality briefing, train managers on referral boundaries, review workload in a growing function or make booking information accessible to frontline staff.
5. Follow-up from the previous period
Record what the organisation changed and whether the barrier improved. Reporting becomes more credible when it tracks action rather than merely presenting charts.
Questions HR should ask an EAP provider
- What information is collected, and why is each field needed?
- What will employees be told before they use the service?
- Which data will HR receive, and at what level of aggregation?
- How are small groups and unusual cases protected?
- Who can access clinical and operational records?
- How long is information retained, and how is it secured?
- What are the limits of confidentiality in a safety or legal situation?
- How will a possible privacy incident be managed?
Organisations should review their obligations under applicable Malaysian data-protection requirements and obtain appropriate legal or privacy advice for their specific arrangements.
Communicate reporting to employees
Do not keep the reporting model hidden. Explain in plain language that the employer may receive aggregate programme information but not the content of counselling conversations. Give examples of what HR can and cannot see.
This complements the trust-building steps in Why Employees Don’t Use EAP: Confidentiality, Stigma and Trust.
The bottom line
The best EAP report is not the one with the most data. It is the one that helps HR improve access and working conditions while preserving the trust that makes employees willing to seek help. Measure the programme, not the private life of the person using it.
Learn more about MY Psychology’s Employee Assistance Program or explore the EAP Resource Library.
References
- Personal Data Protection Commissioner Malaysia: Personal Data Protection Act 2010 and Current Guidance
- Public Service Department Malaysia: Guidance on Psychological Information Security
- Employee Assistance Professionals Association UK: EAP Standards
This article provides general EAP governance information and is not a substitute for legal, privacy, information-security or clinical advice for a specific organisation.
