Can Your Employer Contact Your Doctor to Verify a Sick Note? Privacy Rights Explained
A manager who picks up the phone and calls an employee's doctor to confirm a sick note is not doing routine paperwork. Canadian privacy law treats that call as the collection of sensitive personal health information, and it comes with real limits. The Office of the Privacy Commissioner of Canada and provincial statutes such as Ontario's Personal Health Information Protection Act start from the same principle: a physician cannot discuss a patient's health information with a third party, including an employer, without the patient's consent. An employer who wants to verify a sick note is allowed to confirm that the document is real. They are not allowed to use that request to find out what is actually wrong with the employee.
Who Controls the Information in a Doctor's Note
A doctor's note is written by a physician, but the information in it belongs to the patient first. Once the note is handed over, the employee decides what to share with an employer and how much detail to include on top of the minimum the workplace requires. An employer who receives a note directly from an employee is not entitled to go around that employee and contact the clinic separately for more detail, because doing so sidesteps the consent the employee already gave when they chose what to disclose and how.
Physicians carry a legal and professional duty of confidentiality that exists independently of what an employer wants to know. In Ontario, that duty is set out in the Personal Health Information Protection Act, 2004, which defines physicians as health information custodians and restricts what they can disclose, and to whom, without consent. Every provincial college of physicians and surgeons enforces a comparable standard through its own code of conduct, and the Canadian Medical Association's Code of Ethics and Professionalism treats patient confidentiality as a baseline obligation rather than a courtesy that can be waived by an employer's request.
What Canadian Privacy Law Actually Allows
For federally regulated employers, including banks, airlines, and telecommunications companies, the Personal Information Protection and Electronic Documents Act, known as PIPEDA, governs how personal information is collected and used, and it requires meaningful consent before an organization collects sensitive details such as health status. Employees working for provincially regulated private employers are covered by comparable frameworks in several provinces, and by common law privacy protections in the rest.
Meaningful consent requires more than a line buried in an offer letter or employee handbook signed months before any absence occurred. Privacy regulators have repeatedly found that consent needs to be specific to the actual collection being made, which is part of why a blanket, pre-signed authorization rarely holds up as valid consent for a single, after-the-fact call to a physician's office.
Courts have also recognized a standalone privacy claim that applies even outside a specific privacy statute. In Jones v. Tsige, 2012 ONCA 32, the Ontario Court of Appeal confirmed that intruding on someone's private affairs without justification, including their health records, can be sued on its own, without any need to prove financial loss. An employer who contacts a treating physician to dig for medical details beyond what was actually consented to is operating in exactly the territory that decision was written to cover.
What a Doctor's Office Will Actually Confirm
Clinics are used to employer phone calls, and most have a standard response: they will not discuss a patient file with anyone who calls in, consent or no consent, because there is no reliable way to verify who is actually on the other end of the line. What a clinic will usually do, once an employee provides a signed release naming the employer and the specific purpose, is confirm narrow facts such as whether the note was issued by that office and on the date shown, and nothing beyond that.
In practice, this means an employer that calls a clinic cold, without a release in hand, is very likely to be told nothing at all, sometimes not even a confirmation that the person is a patient there. That refusal is not the clinic being difficult. It is the clinic following the same confidentiality rules that would apply to any other third party making the same call.
A release broad enough to invite a conversation about diagnosis, treatment, or prognosis is unusual, and a responsible clinic will push back on it even with a signature attached, because the physician's own confidentiality obligations do not disappear just because a form was signed under workplace pressure.
How the Rules Differ by Province
Health privacy in Canada is mostly regulated at the provincial level, with federally regulated workplaces following a separate federal framework, so the practical limits on verifying a note shift depending on where the employee actually works.
Ontario - The Personal Health Information Protection Act, 2004 governs how physicians and clinics handle health records, and nothing in the Employment Standards Act gives an employer the right to bypass the employee and contact a provider directly.
Alberta - The Personal Information Protection Act applies to private-sector employers, and the Health Information Act places further restrictions on custodians like physicians, so a direct call to a clinic still needs a specific, signed authorization.
British Columbia - BC's Personal Information Protection Act sets similar consent requirements for private employers, while the Freedom of Information and Protection of Privacy Act covers public-sector employers such as school boards and health authorities.
Quebec - The Act respecting the protection of personal information in the private sector requires explicit, informed consent before an organization collects health information, and Quebec's regulator has historically taken a strict view of employer requests in this area.
Federally regulated employers - Banks, airlines, telecommunications companies, and other federally regulated workplaces follow PIPEDA, which sets out consent as a core principle for collecting sensitive personal information such as health status.
Employees are often unsure whether they fall under federal or provincial rules. The clearest marker is the industry: airlines, banks, telecommunications, broadcasting, and interprovincial transportation are federally regulated, while almost everything else, including retail, hospitality, manufacturing, and most office jobs, falls under the applicable provincial employment and privacy framework.
How Employers Can (and Can't) Verify a Sick Note
Employers who have a genuine reason to confirm a note is authentic, rather than curiosity about the underlying medical issue, generally stay within a narrow set of steps.
Picture an employee who has called in sick three Mondays in a row. The employer's suspicion might be reasonable, but the response has to stay proportionate: confirming that a note is genuine is a reasonable ask, while demanding to know the employee's diagnosis to justify the pattern is not, because the employer's actual entitlement is proof of incapacity, not a medical history.
A written request to the employee first - The employer asks the employee to confirm the note's authenticity rather than contacting the clinic directly without warning.
A specific, time-limited consent form - If a direct call to the clinic becomes necessary, the employee signs a release naming exactly what can be confirmed, usually limited to the issue date and the fact that a licensed provider issued the note.
No request for diagnosis or treatment details - The employer's legitimate interest is whether the employee needs the time off, not what condition caused it.
A documented reason for the request - Verification tied to a specific, stated concern, such as a pattern of short-notice absences, holds up far better than a blanket policy of verifying every note that comes in.
When an employer's real concern is simply whether a note reflects an actual medical assessment, documentation tracked through our sick leave notes service removes most of the reason to call anyone in the first place, since each certificate is already tied to a licensed physician's review and can be confirmed through the issuing record instead of a phone call to a clinic.
What to Do If Your Employer Oversteps
If an employer contacts a physician's office directly without consent, or asks a doctor for information beyond what a signed release covers, the employee has real options. The first step is usually a written request to HR asking exactly what was requested and from whom, since employers are expected to keep a record of the personal information they collect.
If that does not resolve things, a complaint can be filed with the Office of the Privacy Commissioner of Canada for federally regulated employers, or with the relevant provincial privacy regulator otherwise. Where the overreach is tied to a disability or a medical condition, it can also raise a human rights issue, since prying into diagnosis details unrelated to fitness for work has been treated as discriminatory conduct in prior tribunal decisions.
In more serious cases, especially where the contact appears to have influenced a disciplinary decision or a termination, speaking with an employment lawyer before responding to HR is worth the hour it takes, since an unauthorized disclosure can also become relevant evidence in a wrongful dismissal or human rights claim.
Employees who want documentation that is harder to dispute in the first place often rely on our medical certificates service, which issues notes from a licensed physician's assessment and keeps a verifiable record an employer can check without ever needing to contact a treating doctor.
The Bottom Line
Verifying a sick note is legitimate. Turning that verification into an investigation of someone's medical history is not, and Canadian privacy law draws that line clearly even when workplace policy tries to blur it. Employees who understand where consent is required, and employers who build verification requests around that boundary, avoid most of the disputes that end up in front of a privacy regulator or an employment lawyer.
Frequently Asked Questions
Can my employer call my doctor without telling me?
No, not legally. A physician cannot discuss your health information with your employer without your consent, and a reasonable employer asks you first rather than contacting your doctor's office directly.
What can my employer actually confirm about my doctor's note?
With your consent, an employer can typically confirm that a licensed provider issued the note and the date it was issued. They cannot use that same request to learn your diagnosis or treatment plan unless your consent specifically covers that information.
Is it legal for my employer to ask me to sign a consent form to verify a sick note?
Yes. Asking for a signed, specific consent form is a normal and reasonable step. What matters is the scope: a form limited to confirming authenticity is reasonable, while one broad enough to authorize a full discussion of your medical history generally is not.
Can I refuse to let my employer contact my doctor?
Yes, and refusing does not automatically give your employer grounds for discipline. If they have genuine doubts about a note's authenticity, there are narrower ways to confirm it that do not require access to your full medical file.
What happens if my employer contacts my doctor without my consent?
That can expose the employer to a privacy complaint with the applicable federal or provincial regulator, and in some cases a civil claim for intrusion on your privacy. Keep a record of what happened and raise it with HR in writing as a first step.
Does this apply the same way in every province?
The core principle, that consent is required before your health information is shared, holds everywhere in Canada. The specific law that applies, and the regulator you would complain to, depends on whether your employer is federally or provincially regulated and which province you work in.
Comments