Can an Employer Verify a Medical Certificate With the Issuing Clinic?

Yes. An employer can contact an issuing clinic to check whether a medical certificate is genuine, particularly where there is a reasonable authenticity concern. Verification should normally be limited to confirming the document rather than seeking the employee’s diagnosis, consultation notes, medicines or treatment.

The clinic must protect patient confidentiality, verify the caller and follow its privacy process. Confirming that the clinic issued an unaltered certificate is different from answering additional questions about why the patient was unwell or whether the employer should approve leave.

An employer should use independently sourced clinic details, tell the employee what concern is being checked and record only the information necessary for the workplace decision. A failed phone call, slow response or clinic closure does not automatically prove the document is false.

For the employer’s general evidence right, read Can an Employer Ask for a Medical Certificate?. The introductory guide What Is a Medical Certificate? explains ordinary contents and purpose.

This page provides general workplace and privacy information, not legal advice about a disciplinary process or suspected fraud. The applicable policy, industrial instrument, privacy framework, consent and evidence facts must be assessed individually.

Key Points

• An employer can take proportionate steps to check certificate authenticity.
• It should contact the clinic through independently verified details.
• Authenticity verification is different from requesting clinical information.
• The clinic should verify the employer’s identity before responding.
• A diagnosis or medical record should not be disclosed merely because the employer asks.
• Express patient consent may be needed for information beyond basic veracity.
• The employee should have an opportunity to explain or provide the original document.
• The Ahpra register confirms registration, not whether a specific document was issued.
• Electronic certificates can use secure links, codes or controlled verification channels.
• Suspected alteration should be investigated fairly and confidentially.

Medical Certificates

What “Verification” Should Mean

A basic verification asks whether the clinic or named practitioner issued the certificate and whether the copy presented matches its record. It can also identify obvious alterations to dates, patient name or practitioner details.

It does not ordinarily require the clinic to repeat the history, explain clinical reasoning or send a consultation record. The practitioner’s medical notes exist for healthcare and professional record-keeping, not as a routine HR evidence bundle.

The employer remains responsible for deciding whether the certificate, notice and leave entitlement satisfy workplace requirements. The clinic does not approve payroll or discipline.

Verification Is Not a Clinical Second Opinion

Reception staff confirming that a certificate is genuine should not be asked to justify why the practitioner selected three days instead of two. They are not conducting a new assessment, and authenticity confirmation does not open the practitioner’s reasoning to informal cross-examination.

If the employer has a legitimate current-capacity or safety question, it should describe that question separately and obtain appropriate consent, further evidence or advice about a lawful assessment process. The employee should know whether the request concerns past absence, present fitness or workplace adjustments.

The practitioner is not the employer’s investigator and is not required to change an honest opinion to satisfy staffing preferences. Equally, a genuine signature does not require the employer to accept evidence for a purpose it does not address. Keeping these roles separate produces a clearer and fairer process.

Australian Medical Association Guidance

The Australian Medical Association’s certificate guidance says that when an employer contacts a practitioner to check whether a sickness certificate is fraudulent, the practitioner should verify the employer’s identity and confirm the certificate’s veracity.

The same guidance says the doctor should not provide other patient information without express consent. If the employer seeks further relevant information in reasonable circumstances, identity and consent should be addressed first.

That distinction gives both sides a practical boundary: authenticity can be checked without turning verification into an unrestricted medical interview.

When an Employer May Verify

Verification may be reasonable where formatting is inconsistent, dates appear altered, practitioner details do not match, a verification code fails, the employee supplies only a cropped image or a document appears to come from a clinic that denies using that format.

A workplace can also use a consistent risk-based process for all electronically submitted certificates. It should avoid targeting an employee because of disability, ethnicity, pregnancy, union activity or another prohibited attribute.

Routine verification of every document can create delay and privacy risk. Employers should consider whether the evidence already satisfies a reasonable person and whether the check is proportionate.

Fair Work Evidence Standards

The Fair Work notice and evidence page says evidence must satisfy a reasonable person that the employee was genuinely entitled to sick or carer’s leave. It may be requested for one day or less.

Fair Work does not require employers to accept an obviously altered document without enquiry, nor does it give them unlimited access to clinical records. The award, agreement or policy can add relevant evidence processes.

The guide What Makes a Medical Certificate Valid? explains how issuer authority, assessment, dates and integrity work together.

How the Employer Should Contact the Clinic

Find the practice through its official website, public directory or trusted health service listing rather than relying only on a phone number printed on a suspicious copy. This reduces the risk of calling an accomplice or fake verification service.

Provide the employer representative’s name, organisation, role, callback details and the minimum certificate identifiers. Ask for the clinic’s verification procedure and be prepared to send the document through its secure channel.

Do not send a medical certificate to an unverified email address. Record the date, contact method and limited result without copying extra patient information into a broad HR note.

What the Clinic Can Confirm

Subject to its process, the clinic may confirm that it issued the certificate, that the practitioner worked through the clinic, and that the document appears consistent with its record. It may decline to discuss any clinical fact.

Even dates can reveal health information, so the clinic may require a copy, patient authority or another controlled method. Employers should not pressure reception staff to disclose information outside their authority.

If a genuine clerical error exists, the clinic can arrange correction through the practitioner’s record process. The employer or employee should never edit the file themselves.

When Patient Consent Is Needed

An employer asking “Did your clinic issue this document?” is narrower than asking “What condition did the employee have, what symptoms were reported and why were three days necessary?” The second set seeks clinical information beyond simple authenticity.

The OAIC health information guidance says health providers generally need consent or another lawful basis to disclose health information.

Consent should be informed and specific about the recipient, information and purpose. A general employment relationship or submission of a certificate is not automatically blank consent to release the full record.

The Ahpra Register’s Role

The Ahpra Register of practitioners can confirm whether the named practitioner is registered and show public conditions or undertakings. Search carefully because names can be similar.

A matching entry is useful but not conclusive. Practitioner names and registration details are public and can be copied onto fake documents.

A missing result also needs careful checking for spelling, former names, profession and public-registration exceptions. Contact Ahpra or the clinic before making a serious allegation.

Book Online Consultation

Electronic Verification

A legitimate electronic certificate may include a QR code, verification URL, unique document number or secure PDF feature. Use only the issuer’s official domain and avoid entering employee data into an unfamiliar website reached through a suspicious link.

Electronic signatures can look different from pen signatures. The article Does a Medical Certificate Need a Doctor’s Signature? explains typed, electronic and handwritten attestation.

If the code has expired or fails, contact the clinic through an independent channel. A technical failure is a reason to investigate, not proof of fabrication.

If the Clinic Cannot Verify Immediately

The practice may be closed, archived records may take time, the practitioner may have left or reception staff may not be authorised to answer. The clinic might ask the patient to provide consent or use a written form.

The employer should give a reasonable opportunity for clarification, considering payroll deadlines and the seriousness of the concern. It can make an interim leave decision under policy without publicly accusing the employee.

The employee can contact the clinic, provide the original file and authorise narrowly defined verification. Silence should be addressed, but it should not be converted automatically into a fraud finding.

Can the Employer Ask for More Evidence?

A genuine certificate can still be insufficient for a different legitimate purpose, such as current fitness for safety-critical work, workers compensation capacity or a prolonged absence requiring updated information.

That is a request for further evidence, not authenticity verification. It should be framed separately so the clinic and employee understand what information is sought and why.

Read Can an Employer Ask for More Evidence After a Medical Certificate? for scope and reasonableness considerations.

Privacy Inside the Workplace

HR should limit the certificate and verification result to authorised staff. A manager may need the supported absence dates without receiving the practitioner’s full correspondence.

The guide Must HR Keep Your Medical Certificate Confidential? explains the Fair Work record rule and federal employee-record exemption nuance.

Verification should not become workplace gossip. Suspicions and outcomes should be recorded neutrally and corrected if the document is confirmed genuine.

If Alteration or Fabrication Is Confirmed

The employer should preserve the original, verification record and employee response. It should follow the applicable investigation and disciplinary process rather than editing the document or making public allegations.

The employee should have an opportunity to respond because transmission corruption, clinic error or identity confusion can sometimes explain a discrepancy. Serious misconduct conclusions require reliable facts.

Fake Medical Certificates: Risks in Australia covers employment, fraud and practitioner-impersonation consequences.

Practitioner Accountability

The Medical Board of Australia’s code of conduct requires doctors to be honest, verify certificate content and sign only documents they believe are accurate.

A clinic should keep an appropriate record of documents issued and protect signature assets and verification systems. It should correct genuine errors transparently.

An employer concern about practitioner conduct should be distinguished from a disagreement about the employee’s leave. Regulatory complaints should not be threatened merely to pressure the doctor into disclosing confidential information.

A Fair Verification Checklist

1. Identify the specific authenticity concern.
2. Ask the employee for the complete original file or page.
3. Check the practitioner on the Ahpra register.
4. Find the clinic’s official contact details independently.
5. State the employer representative’s identity and limited purpose.
6. Use the clinic’s secure verification process.
7. Do not seek diagnosis or notes without a lawful basis.
8. Give the employee a reasonable chance to respond.
9. Store the outcome confidentially and correct inaccurate suspicions.

More of Our Services

Using Dociva

Dociva currently supports online sick-leave, carer's leave, study and multi-day medical certificate requests. Any certificate is created only after independent assessment by an Australian registered medical practitioner; an application does not guarantee issuance.

Dociva can follow its authenticity-verification process for a legitimate employer enquiry while protecting patient confidentiality. It does not provide unrelated diagnosis, notes or treatment information merely because an employer calls.

For a current work-affecting illness, review the medical certificate application. Keep and submit the original document without alteration.

Frequently Asked Questions (FAQs)