If the only thing stopping HR from seeing a diagnosis is a policy, employees are right to assume it can be seen. The boundary has to be in the system’s structure, not in its rules.
The two columns
Every corporate health arrangement has a line running through its data. On one side is what the employer is paying for and entitled to verify. On the other is the employee’s clinical life. The programmes people actually use are the ones where that line is drawn in the architecture rather than in an undertaking.
| Employer sees | Employee only |
|---|---|
| That a person is covered | What they attended for |
| That a visit took place, and its date | The diagnosis |
| The invoice, and what it covers | Test results and their values |
| Aggregate participation across the workforce | Prescriptions and medication history |
| Cap consumed against cap available | Referrals and onward treatment |
| Camp and screening attendance counts | Any individual clinical finding |
The right-hand column has no route to the left-hand one. Not a restricted route, not a logged route — no route. That distinction is the entire product from an employee’s point of view.
Why aggregate reporting is not a loophole
Employers reasonably want to know whether a programme is working. Aggregate reporting answers that without crossing the line, provided the aggregate is genuinely one: a small-headcount department reported on its own can identify an individual as effectively as naming them. Suppression below a floor is not caution, it is a requirement.
What this changes commercially
An employer buying a health benefit is buying utilisation. A benefit nobody uses costs the same and returns nothing. Employees use programmes they trust, and they establish trust from the architecture rather than the brochure — which is why the boundary belongs in the sales conversation, not in the annexure.
Questions we get asked
Can an employer see an employee’s diagnosis under a corporate health programme?
Not under a properly constructed one. The employer needs to verify that a covered person received covered care and that the invoice is correct; none of that requires a diagnosis. Where a system can technically surface clinical detail to an employer, employees are correct to assume it eventually will, and utilisation falls accordingly.
Is aggregate health reporting to an employer safe?
Only with a suppression floor. An aggregate over a whole workforce reveals nothing about an individual, but the same report cut by a four-person department can identify someone precisely. Reporting has to refuse to render below a minimum group size rather than leaving that judgement to whoever runs the report.
On the figures in this piece. Every rupee amount above is arithmetic on the assumptions stated beside it, not a market statistic. Where you need published Indian claim data with its source named, that sits on claim data. We publish no figure we cannot show the working for.