How Employers Can Verify a Doctor’s Note — Fairly and Within Privacy Rules
Fake doctor’s notes are a click away. What HR can reasonably check, how to verify a note with the employee’s consent, and the privacy lines not to cross.
Templates for doctor's notes are everywhere online, and some sites sell "real-looking" notes for a few dollars. Most notes employees submit are genuine — but HR teams still need a fair, consistent way to handle the occasional fake, without crossing privacy lines.
What a legitimate note usually contains
- The provider's or clinic's name, address and phone number.
- The date of the visit or consultation.
- The dates the employee was or will be unable to work, or any work restrictions.
- A signature or an electronic authentication from the provider.
It usually does not need to include a diagnosis — and employers generally shouldn't ask for one.
Telehealth notes are legitimate too. A note from an online provider isn't suspicious in itself; what matters is whether the provider is real and the note was actually issued.
What HR can reasonably check
- Provider details — a real clinic or practice, with an address and phone number you can find independently.
- Dates — the visit date and the period of absence make sense together; an edited "1 day" that became "4 days" is a classic change.
- Consistency — fonts, spacing and alignment are uniform; edited dates and numbers often stand out when zoomed in.
- File origin — a note produced by a clinic's system looks different, under the hood, from one made in a design app or edited in a PDF editor.
- Patterns — the same template from different "clinics," or the same file submitted twice.
Red flags
- A clinic name you can't find anywhere, or a phone number that goes to a personal line.
- Generic wording that could apply to anyone, with no provider details.
- Dates that were visibly changed, or a note issued before the visit it describes.
- A note that matches a template from an online "doctor's note generator."
Verifying a note
If you have a legitimate reason to doubt a note, ask the employee to authorize the provider to confirm that the note was issued — limited to authenticity and dates, not diagnosis. Call using contact details you find yourself, not the ones on the note. Many clinics will confirm whether a note came from them without sharing any medical information.
Privacy lines
Health-privacy laws such as HIPAA mainly govern doctors and health plans; employers have their own obligations. Generally, employers should not ask for diagnoses beyond what policy and law allow, and medical information must be kept confidential and stored separately from personnel files. Leave programs such as FMLA, ADA accommodations and state sick-leave laws have their own rules about what you may request — check them before you ask for more documentation.
A fair process
- Write a sick-leave documentation policy and apply it to everyone.
- Decide in advance when a note is required (for example, after a number of consecutive days).
- Treat a suspicious note as a reason to verify, not as proof of misconduct.
- Talk to the employee before reaching any conclusion, and keep notes of the conversation.
Where automation fits
ThisVerify checks notes and medical documents for edited dates and days, altered provider details and editing software, without anyone on your team reading more medical detail than necessary.
Related guides
FAQ
Can an employer call the doctor to check a note?
Generally only to confirm authenticity, ideally with the employee’s authorization, and without asking about diagnosis. Follow the privacy rules that apply to you.