Back to all blog posts

Posted in: Data Security/Privacy | Privacy

May 8, 2020

Maintaining Employee Mental Health through Digital Technologies

By Lynn Tay and Lorway Gosse

The rapid advancement of technology has resulted in a movement towards all kinds of digital tools. One tool that a growing number of employers are embracing is telemedicine. By leveraging technology, employers provide employees with access to professional advice in a convenient and cost-effective manner, ultimately improving employee relations.

What is Digital Cognitive Behavioural Therapy

Digital cognitive behavioural therapy is a popular telemedicine tool that is gaining traction among employers. Cognitive behavioural therapy (“CBT”) was developed in the 1960s by Aaron Beck, a psychiatrist who observed that his patients were not fully aware of their internal dialogues which were contributing to their emotions. CBT guides people to learn to identify, question and change how their thoughts, attitudes and beliefs relate to their emotional and behavioural reactions.

Guided digital CBT programs begin with a questionnaire, followed by an assessment by a healthcare professional. Based on the assessment, the client is given a customized care path. The client then works through modules, which may contain videos, activities and assignments, which help them learn and practice new skills. A healthcare professional monitors the client’s progress, providing advice and support through phone, video or chat, and adjusting the care path as needed.

Benefits of Digital CBT Programs for Employees and Employers

Mental health is a growing challenge in Canada – 50% of Canadians by the age of 40 have or have had mental illness.1 Although CBT is not recommended for all mental health conditions, it can be effective for anxiety and depression. Access to medical help can be cost-prohibitive, time-consuming and challenging. Digital CBT allows employees to move through therapeutic programs at their own pace, when and where convenient, ultimately improving employees’ mental health.

Digital CBT programs may also allow employers to proactively reduce the economic cost of poor mental health. In Canada, absenteeism, presenteeism and turnover from mental illness results in $6 billion in productivity losses a year.2 Investing in CBT programs that offer care management (such as guided digital CBT programs that offer customized care plans) has been shown to generate significant returns. For every dollar invested, employers may see returns of $0.39 to $3.35 per participating employee after one year.3 Employers who invest in digital CBT tools may expect improvements in the work environment and increases in productivity and performance, which ultimately translate to economic benefits.

The COVID-19 health pandemic and the ensuing self-isolation and social distancing policies have significant altered the day-to-day lives of all employees. This unique health and economic environment has contributed to mental health concerns such as anxiety, and has exacerbated underlying mental health conditions. During these times, employers may turn  to digital CBT tools, which are conveniently accessible from home, to support employees.

Risks and Legal Issues Associated with Digital CBT

Employers offering digital CBT tools to employees may be concerned that they will be seen as providing medical advice, which carries the prospect of legal liability. However, employers are mere intermediaries that connect third-party providers with employees. Employees ultimately enter into a direct relationship with the mental health care provider. Therefore, the risk associated with providing medical advice rests with the professional provider and not the employee. Employers’ concerns may be addressed through a simple and comprehensive disclaimer stating that the employer is not providing medical advice or medical services, and that the medical advice provided by the CBT provider is independent of the employer. Additional comfort may be available to employers who allow employees to choose their provider from a roster of mental health-care professionals.

Employers may also be concerned about the legislation around personal health information. Personal health information is defined in the Personal Health Information Protection Act (“PHIPA”) to include identifying information relating to the mental health of an individual, and identifying information relating to the provision of health care to an individual.4 Identifying information is defined as information that identifies or that, it is reasonably foreseeable, could be used to identify an individual.5 As employers are enlisting third-party technology providers that operate their own platforms, it is the CBT providers (or the mental health professionals who use the CBT providers’ platforms) rather than employers who collect personal health information. Depending on the business model, CBT providers could be health information custodians under PHIPA, if they have custody or control of personal health information in connection with a mental health service.6 Therefore, PHIPA imposes requirements on the collection, use and disclosure of personal health information by CBT providers or the mental health care providers who use the CBT platforms. Employers can thus address concerns relating to personal health information by including a statement in their disclaimers that they are not collecting or using employees’ personal health information, nor do they have any right of access to it.

Measuring Outcomes of Digital CBT

How will Employers Determine Success of CBT Programs?

An employer investing in a digital CBT program may want to assess whether the program is improving employee retention, absenteeism and presenteeism. These metrics are difficult to track and measure, especially given the sensitive nature of personal health information.

CBT providers cannot disclose any personal health information to employers unless they obtain express consent from the employees.7 They are unlikely to get that consent and are even unlikely to make an effort to get it. However, CBT providers may be able to de-identify personal health information and provide anonymized and aggregated data to employers. The risk with this is that data will not be properly de-identified, and the transmission of data from the CBT provider to the employer will constitute a breach of PHIPA. If employers wish to receive de-identified data, they should consider asking CBT providers to obtain consents from employees or insist that the data be “salted” and hashed and aggregated with the data of other employers.

Throughout the course of CBT therapy, employees measure symptoms in order to track any improvements in symptoms or affect. Absent express consent, employers will not be able to receive specific data for each employee. Therefore, employers may wish to track productivity and retention over a period of time to assess whether there are improvements generally across all employees. Employers may also consider seeking feedback from employees on their satisfaction with the CBT initiatives.

Can CBT Providers Provide Useful Insights into Benefits of CBT Programs?

Digital CBT providers may wish to anonymize and aggregate data across all its users to provide useful insights into the benefits of their platforms. Providers may want to consider including provisions in their privacy policy that notifies clients that personal health information may be de-identified and used in aggregate form, or anonymized, for the purposes of research, performing analytics, advertising and promotion. Those consents will be captured during the digital “on-boarding” process to the platforms. Ultimately, providers will want to ensure that they are appropriately handling personal health information, and are not jeopardizing the privacy of its clients.

Can Data be Aggregated as an Industry to Inform Public Health?

Under PHIPA, CBT providers may disclose personal health information for “research purposes,” as long as the prescribed legislative requirements are met.8 This allows for research studies on the effectiveness of digital CBT programs. CBT providers may also disclose personal health information for “purposes related to planning and management of health system.”9 Such disclosure would be limited to entities specified in PHIPA regulations, such as the Canadian Institute for Health Information.10

As telemedicine gains traction, digital CBT providers may be able to assist with the development of accessible and cost-effective public health-care policies to treat anxiety disorders, and mild to moderate depression. This also provides an opportunity for the province to consider whether such studies should be publicly available, and whether they can be used to inform public health decisions.


1 Smetanin et al., The life and economic impact of major mental illnesses in Canada: 2011-2041 (December 2011), online: Mental Health Commission of Canada <https://www.mentalhealthcommission.ca/sites/default/files/MHCC_Report_Base_Case_FINAL_ENG_0_0.pdf>.

2 Mental Health Commission of Canada, Making the Case for Investing in Mental Health in Canada (June 2016), online: Mental Health Commission of Canada <https://www.mentalhealthcommission.ca/sites/default/files/2016-06/Investing_in_Mental_Health_FINAL_Version_ENG.pdf>.

3 The Centre for Addiction and Mental Health, Workplace Mental Health A Review and Recommendations (January 2020), online: The Centre for Addiction and Mental Health <https://www.camh.ca/-/media/files/workplace-mental-health/workplacementalhealth-a-review-and-recommendations-pdf.pdf?la=en&hash=5B04D442283C004D0FF4A05E3662F39022268149>.

4 Personal Health Information Protection Act, 2004, SO 2004, c 3, s 4(1)(a)-(b).

5 Ibid at s 4(2).

6 Ibid at s 3(1)(vii).

7 Ibid at s 18(3).

8 Ibid at s 44.

9 Ibid at s 45.

10 O Reg 329/04 at s 18(1).

Areas of Expertise

Related Industries

Related Categories

Related Blogs

Posted in: TheSpotlight Categories

Insights TheSpotlight
Smart Devices at Home and Maintaining Confidentiality Are Your Smart Devices Listening to Your Confidential Discussions? How to Secure Your Devices and Protect Your Data By Paige Backman and Andy Nguyen May 01, 2020

Posted in: Privacy by Design | Data Security/Privacy

Insights TheSpotlight

Posted in: Data Security/Privacy | TheSpotlight Categories

Insights TheSpotlight
Geolocation and the Fight Against COVID-19 Could the Emergencies Act Overrule Privacy Law Protections for Cellphone Location Data? By Paige Backman and Stephanie D’Amico Mar 27, 2020