Search

Securely Storing Employee Files & Records

Learn how to protect your business from cyber attacks and comply with employee record retention regulations:

Keep reading to download the Employee Record Retention Guide.

Employers have access to an incredible amount of information about their employees: dates of birth, Social Security Numbers, bank account information, background/criminal history reports, tax forms, medical records, employment histories, performance reviews, compensation histories and much, much more.

In the wake of high-profile cyber attacks, in which information from several employees’ personnel files was leaked to the public, many employers and HR professionals are taking a second look at how secure their employees’ personal information and records are.

How to securely store your employee records.

While parts of some federal laws (HIPAA, ADA) establish guidelines on how employers should secure or grant access to certain aspects of employee files (like medical records), there is not one specific filing system that employers are required to use. Employers should, however, familiarize themselves with any state-specific regulations regarding employee/personnel files.

One of the more common filing systems employers use is the two-part filing system. In this system, the employer keeps two separate files for each employee: a “personnel” file and a “confidential” file. The personnel file would typically house items that require less security, like resumes and discipline records, while the confidential file would contain items that require more security, like medical histories and personally identifiable information.

How long are you required to maintain employee records?

One aspect of employer record maintenance that seems to trip many organizations up is exactly how long they are required to keep certain types of records. Federal law requires that employers keep and maintain certain information pertaining to each of their employees for a certain length of time. But exactly how long an employer has to keep a particular employee record on file varies depending on the employment and labor law compliance regulations established by the relevant legal authority that governs the information contained therein.

Looking for ways to reduce turnover?

Download our whitepaper to gain a better understand of how turnover affects your company and what you can do to minimize it.

Download the whitepaper

Next: An easy-to-use employee record filing system any business can use...

The "Traffic Light" Employee Record Filing System

Sue Willman, an employment attorney with Spencer, Fane Britt & Browne LLP in Kansas City, Missouri, recommends taking your employee records filing system a step further. In an article published in the Society For Human Resource Management’s HR Magazine, Willman outlines a three-part filing system she calls the “Traffic Light” filing system to designate the level of access to specific employee records. In this system, documents are designated as green (unrestricted access), yellow (access restricted as needed) and red (most restricted access). Below are some examples of what might be included in each of these files.

Green

The green file should be considered as the official “personnel file.” People who might be given access to this file include the employee’s manager or supervisor, HR staff and HR managers. Documents kept in this file might include:

  • Employment application/resume
  • Licenses and certifications
  • Equipment and property check-out forms
  • Training records
  • Performance reviews
  • Disciplinary records
  • Employee awards documentation

Yellow

The yellow file should be considered the “confidential file.” Only HR staff should have access to this file. Documents kept in this file might include:

  • Background check/criminal history reports
  • Pre-employment screening results
  • I-9 forms
  • Benefits election forms and other related documents
  • Tax forms (W-2, etc.)
  • Supervisory notes and correspondence

Red

The red file should be considered the “restricted file.” Only senior-level HR personnel (like the HR manager) should have access to this file. Documents kept in this file might include:

  • Medical histories/evaluations
  • Requests for FMLA leave
  • Requests for ADA accommodations
  • Records related to employee investigations (discrimination, harassment, etc.)
  • Medical files*

*There are separate regulations governing access to medical records. While Willman recommends keeping these in the red file, employers should make themselves aware of the specific rules regarding medical files.

No matter what filing system an employer uses, it needs to be secure. If an employer keeps hard-copy files, they should be kept in a locked cabinet or in a separate, locked room if possible. Electronic files should be treated with an equal level of care.

Employers who are concerned about whether their record-keeping policies meet federal and/or state requirements should consider conducting an audit of their policies regulating access, retention, storage and/or security of employee records.

How long should you keep employee records?

One aspect of employer record maintenance that seems to trip many organizations up is exactly how long they are required to keep certain types of records. Federal law requires that employers keep and maintain certain information pertaining to each of their employees for a certain length of time. But exactly how long an employer has to keep a particular employee record on file varies depending on the regulations established by the relevant legal authority that governs the information contained therein.

G&A Partners’ experienced HR advisors provide our clients with expert HR support and best practices with multiple aspects of human resources, including conducting assessments of human resources/employment practices.

Learn how G&A Partners can help you protect your business and employees through our labor law and HR compliance services.

Legal Disclaimer
Last Updated

12.18.2014