Vendors, contractors, customers, and the occasional parking garage camera. When outsiders land in a workplace investigation, the rules change, the clock speeds up, and most of an employer’s usual clout disappears.

Picture this. A project coordinator in your Austin office tells HR that the technician from your HVAC contractor has started waiting near her car in the parking garage. He services the building every month. He’s commented on her appearance, asked where she lives, and last Tuesday he followed her into the elevator after hours. He doesn’t work for you. The garage belongs to the property manager. The only person who saw the elevator incident runs the coffee kiosk in the lobby.

So whose problem is this? Yours. Congratulations.

Most investigation processes rest on a tidy assumption: everyone involved draws a paycheck from the same place. Policies, confidentiality instructions, and discipline all depend on it. The moment a vendor, contractor, customer, or former employee steps into the story, that assumption falls apart. You still need to respond promptly and investigate appropriately. You just have far fewer tools to run the investigation.

The Customer Is Always Right. Title VII Disagrees.

Federal regulations have said for decades that an employer may be responsible for sexual harassment of its employees by nonemployees when the employer knows or should have known about the conduct and fails to take immediate and appropriate corrective action. The same regulation tells the EEOC (the Equal Employment Opportunity Commission, the federal agency that enforces workplace discrimination laws) to weigh how much control the employer had over the outsider.

Courts take this seriously. In EEOC v. Costco Wholesale Corp., a federal appeals court upheld a $250,000 jury verdict for an employee whom a customer pursued for about a year. Her supervisors told her to stay friendly and try to avoid him. Costco eventually banned the customer. The verdict stood anyway.

Texas tightened its own rules in 2021. Senate Bill 45 extended state sexual harassment claims to employers with as few as one employee, reached individuals who act directly in an employer’s interest, and adopted the knew or should have known standard paired with a duty to take immediate and appropriate corrective action. Small businesses that once sat outside the statute now sit squarely inside it.

One more wrinkle. In January 2026, the EEOC voted 2 to 1 to rescind its 2024 harassment guidance in its entirety. That guidance was never binding law. Title VII (the federal law that bans workplace discrimination and harassment), the regulation above, private lawsuits, and state statutes like the Texas Labor Code all remain in force. Treat the rescission as a change in the agency’s commentary, not a permission slip.

Three Ways Outsiders Crash the Party

Outsiders show up in investigations in three roles. Each one needs a different approach.

The accused

The person accused of misconduct doesn’t work for you. Think of a vendor’s technician, a staffing agency worker, a delivery driver, a client’s account manager, or a customer. This is the most common setup and the hardest, because you can’t discipline someone you don’t employ.

The witness

The person who saw what happened doesn’t work for you. That’s routine in retail, hospitality, healthcare, and any business with a lobby. When your employee was alone with the accused, an outside witness may be the only corroboration (i.e. proof that backs up her story) you’ll find.

The evidence holder

The proof sits in someone else’s files: a landlord’s camera system, a rideshare company’s trip records, a contractor’s dispatch logs, a building’s access card data, or a medical provider’s chart.

Former employees fit here too. They generally have no employment-based duty to cooperate, and some have an axe to grind. Their evidence can still matter. It just needs to be assessed for credibility, with corroboration sought where available, before anyone leans on it.

Before You Chase It, Ask Whether You Need It

Every outside source makes an investigation slower, pricier, and leakier. Each records request can add weeks. Each outside interview hands sensitive information to someone you can’t discipline for repeating it.

So before sending a single request, ask whether you can resolve each allegation without it. Investigators commonly decide allegations on the preponderance of the evidence, which means more likely than not. If your employee’s account, her texts from that night, a coworker’s observations, and the badge logs already get you there, the garage footage may be a nice extra rather than a necessity.

The math changes when the accused is your own employee and sits on leave pending the outcome. Paid leave costs money every day. Unpaid leave raises its own legal questions. If outside records could add months, consider an interim arrangement, such as a different shift or site, while the investigation finishes.

The Evidence Clock Starts Before HR Finishes Reading the Complaint

Outside evidence has a shelf life. Many commercial camera systems record over older footage on a rolling cycle, sometimes within weeks. Rideshare, transit, and access control records follow their own retention schedules, and none of them were designed around your investigation.

That makes preservation a day one task. As soon as a complaint names an outside location or system, send the owner a short written request to preserve specific footage or records for specific dates and times. You aren’t demanding production yet. You’re asking them not to delete it. A polite, specific request gives the recipient something concrete to act on. A vague one (“please save everything”) is easier to ignore.

Medical records move slower. Under HIPAA (the federal health privacy law), a provider generally has 30 days to act on a patient’s request for her own records, plus one extension of up to 30 more days in permitted circumstances. If your employee wants her records considered, the route usually runs through her: she requests them or signs an authorization. Police records vary by agency and by whether a case remains open, so ask early. Requests to several institutions stack up fast, and a policy deadline of 90 days can disappear before the first envelope arrives.

If the employee won’t consent, ask whether you truly need the record rather than how to get around her refusal. Any medical information that does come in needs restricted access and appropriate confidential handling, not a place in the investigation binder half the management team can open.

Your Vendor Contract Might Be Your Best Witness

Here’s the part most employers miss until it’s too late. Outsiders generally have no obligation to cooperate with your investigation. A contract can change that.

Pull the agreement before you call the vendor. Look for clauses requiring vendor personnel to follow your code of conduct on site, cooperate with investigations, provide records, and leave your premises at your request. If those clauses exist, the conversation shifts from asking a favor to enforcing an obligation. Read the master agreement, every statement of work, and any online terms the vendor attached. A later document can quietly override an earlier one.

If they don’t exist, add them at the next renewal. The language costs less to negotiate when nobody is in trouble and becomes far more valuable when somebody is. Useful terms include:

• compliance with your harassment, violence, and conduct policies by all personnel working at your locations
• prompt notice when vendor personnel are accused of misconduct at your sites
• cooperation with investigations, including reasonable access to personnel, schedules, and records
• your right to require reassignment or removal of specific personnel from your premises
• a duty to preserve relevant records once notified
• an agreed right to share a summary of findings with the vendor
• indemnity (the vendor covers your costs) for claims caused by its personnel’s misconduct
• Proof of insurance that fits the risk, with your company named as an additional insured where possible
• a duty to pass these terms down to subcontractors the vendor sends to your site 
• your right to end the contract if the vendor ignores these duties
• language that keeps cooperation and confidentiality duties in force after the contract ends
• disclosure of any AI tool the vendor uses with your data, your workers, or your sites
• no use of your confidential or investigation information in AI tools that store it or train on it, unless you agreed in writing
• human review of any AI transcript, summary, or recommendation before anyone relies on it
• no AI recording or transcription of meetings or interviews without appropriate consent
• preservation of AI prompts, outputs, and recordings along with other records until notified

Staffing agency agreements deserve the same review. One caution: draft these terms around conduct on your premises, not day to day supervision of the vendor’s workers. Depending on the applicable law and the actual working relationship, too much control over how outside workers do their jobs can fuel joint employer arguments (claims that you are also legally their employer) nobody wants to litigate. Good drafting protects your employees without making you the employer of someone else’s.

When the Outsider Won’t Play Along

Some won’t help. The property manager stops returning calls. The contractor’s HR department says it won’t share anything without a subpoena. Now what?

Start with the soft approach, and mean it. Explain who you are, why you need the information, and how you’ll protect it. Offer to work around their schedule. People may be more willing to help once they understand someone may be getting hurt, and a respectful ask beats a threatening one. Outside counsel and outside investigators can sometimes help make the request more formal.

The hard approach has limits (court orders to hand over records or testify). Subpoenas can compel documents and testimony in lawsuits or certain formal proceedings, including under Federal Rule of Civil Procedure 45. An ordinary internal investigation does not give HR subpoena power. Depending on the proceeding and applicable law, compulsory process may become available through a court or agency. Noting that records could be subpoenaed later is fair. Leaning on it as a threat usually burns more goodwill than it earns.

If an outside source refuses and nothing else fills the gap, document the request, the refusal, and your follow up. An investigation that made reasonable efforts and explains why certain evidence is missing has a stronger record than one that quietly skipped it.

Tell Outsiders Less Than You Think

Fairness requires telling an accused employee enough to respond. Outside witnesses aren’t owed that. Anchor your questions to a date, place, and time. “What do you remember about the lobby on the evening of March 12?” works better than “Did you see the technician harass the coordinator?” The first gets their memory. The second gets your theory.

Then ask them to keep the conversation private, and explain why. If they talk, other witnesses hear a version of events before giving their own, and that testimony loses value. You can’t discipline a barista for gossiping, so the request has to appeal to their sense of fairness. Also ask directly whether they know anyone involved. The witness who turns out to be the accused’s cousin changes how much weight the testimony carries.

A word about your own employees: confidentiality instructions draw scrutiny from the National Labor Relations Board. Broad rules that could discourage employees from discussing working conditions can raise issues under federal labor law. Tailor confidentiality instructions to the specific investigation, explain the reason, and limit them in time when appropriate. Blanket gag orders invite trouble.

Who Gets the Results (Hint: Not Everyone)

When the investigation ends, outsiders will want to know what you found. Most aren’t entitled to much.

Separate the full report from a summary of findings. The full report holds witness names, medical details, credibility assessments, and other material that creates exposure if it leaks. A summary states whether each allegation was substantiated and what happens next. Under a well drafted policy, even the complainant and the accused usually get the summary rather than the report, subject to applicable legal requirements. Outsiders should rarely get more.

The vendor that employs the accused is the common exception. It may need your findings to take its own action, and your contract may require notice. Agree at the outset on what you’ll share, then share a short written summary in neutral, factual language, limited to what is appropriate and legally permissible.

You can’t discipline the vendor’s employee. You can often decide who works on your premises, subject to your agreements and control over the site. Requiring reassignment or barring a specific person from your sites may be the strongest remedy available, and it’s one that can actually protect your employee. What the vendor does next is the vendor’s business. Your job is to investigate appropriately, act promptly, and document both.

Why This Belongs in the Budget

Third party harassment rarely gets its own budget line, but it shows up in several: paid leave while records trickle in, turnover when an employee decides the company didn’t protect her, legal fees when a claim follows, and strained vendor relationships after a messy process. Each of those costs may shrink when contract terms exist before the incident, preservation letters go out on day one, and the investigation plan accounts for outside evidence from the start.  Planning ahead usually costs less than cleaning up afterward.

Who Can Investigate in Texas?

Texas regulates who may conduct investigations for hire. Chapter 1702 of the Texas Occupations Code covers investigations companies and provides exemptions, including for attorneys engaged in the practice of law. The Texas Attorney General has addressed the scope of exemptions for attorneys and their employees, as well as statutory limits involving investigations of outside persons. Before an internal team or a nonattorney consultant starts interviewing outsiders, confirm that the arrangement fits the current statute and any applicable licensing requirements. Working through your attorney is often the simplest way to stay within that rule.

Need a Plan Before the Vendor Stops Returning Calls?

The middle of a harassment investigation is a lousy time to discover that your vendor agreement says nothing about cooperation, your evidence is disappearing, and nobody outside your company is returning calls.

Treaty Oak Employers’ Law Group helps employers navigate workplace investigations, strengthen investigation procedures, and address the gaps in policies and agreements that can make an already difficult situation worse.

If your investigation involves people who don’t work for you, let’s talk about what you can control before the situation gets more complicated.

Frequently Asked Questions

Is an employer liable if a customer or vendor harasses an employee?

It can be. Federal regulations say an employer may be responsible for sexual harassment of its employees by nonemployees when it knew or should have known about the conduct and failed to take immediate and appropriate corrective action. Texas law uses a similar standard for sexual harassment, so prompt investigation and protective steps matter.

Can an employer require a vendor’s employee to take part in a workplace investigation?

Usually not without a contractual or other legal basis. Nonemployees generally have no duty to cooperate voluntarily. Vendor and staffing agreements can establish cooperation requirements, access to records, and removal provisions. Without that language, employers often rely on voluntary cooperation or any compulsory process available through an appropriate legal proceeding.

How quickly should an employer preserve video after a harassment complaint?

Immediately. Many camera systems record over older footage on a rolling cycle, sometimes within weeks. As soon as a complaint identifies a location and time, send the system owner a written request to preserve footage for those specific dates, times, and places. Ask for preservation first and production later.

Should a third party witness receive a copy of the investigation report?

Rarely. Outside witnesses generally are not entitled to the full investigation report. Even the complainant and the accused typically receive a summary of findings rather than the full report, depending on applicable law and policy. When a vendor employs the accused, share a short written summary limited to what the vendor needs and what applicable law or the contract requires.

What can an employer do when it cannot discipline the harasser?

Control access where it has authority to do so. An employer generally cannot discipline a vendor’s worker or a customer as its own employee, but it may be able to require reassignment, bar a person from its premises, change service arrangements, and take appropriate protective measures. These steps can help protect the complainant when direct discipline is unavailable.

Did the EEOC’s 2026 rescission of its harassment guidance change employer obligations?

Not the core ones. The EEOC voted in January 2026 to rescind its 2024 harassment guidance, but that guidance was never binding law. Title VII, applicable EEOC regulations, private lawsuits, and state laws such as the Texas Labor Code remain in force.

Who can conduct a workplace investigation involving outside witnesses in Texas?

Texas law provides certain exemptions from investigations company licensing, including for attorneys engaged in the practice of law. The application of those exemptions to attorney employees, internal teams, and nonattorney consultants depends on the statutory provisions and the particular arrangement. Employers should confirm the licensing requirements under Chapter 1702 of the Texas Occupations Code before assigning an investigation involving outside persons.