An employment reference policy is the internal rulebook that decides what your company says when someone calls to check on a former employee, who is allowed to say it, and what has to be on file before a word leaves the building. A workable policy centralizes every request through HR, limits automatic disclosure to verifiable facts like dates of employment and job title, requires signed consent before releasing anything more, and builds in the steps needed to stay within the Fair Credit Reporting Act, anti-retaliation law, and state record-retention rules. Get the structure right and you protect the company from three different directions of liability at once.
What to Disclose by Default
The default at most companies is a neutral reference confirming only the employee’s dates of employment and final job title. This bare-minimum approach exists because it’s nearly impossible to get sued over facts pulled straight from payroll records. The neutral reference has become so widespread that many HR teams treat it as the only safe option, though the legal picture is more nuanced than that.
Some organizations also include salary history, but that practice is increasingly restricted. Roughly 22 states and two dozen local jurisdictions have enacted laws prohibiting employers from asking about or disclosing salary information, primarily to address pay inequity. If your company operates across state lines, the safest default is to leave compensation out of the standard reference unless the former employee specifically authorizes it.
A more useful data point is rehire eligibility. Many policies include a simple “eligible” or “not eligible for rehire” designation, which communicates a lot to a hiring manager without requiring subjective performance commentary. Companies that use rehire codes should have a documented internal process for assigning them, including HR review before any “not eligible” determination goes into a personnel file. An erroneous coding here can effectively blacklist someone from an industry, and correcting it after the fact is rarely straightforward.
Beyond these basics, some organizations offer a fuller reference that includes performance evaluations, attendance records, or narrative assessments. The moment a reference moves from verifiable facts to subjective opinions, legal exposure multiplies. Your policy should draw a clear line between what’s confirmed automatically and what requires additional authorization and review.
Who Is Authorized to Respond
Nearly every well-drafted policy funnels reference requests through a single point: the HR department. A designated officer or team handles all incoming inquiries, ensuring every response matches company records and stays within the approved disclosure scope. This centralization prevents the conflicting accounts that inevitably arise when multiple managers offer independent feedback about the same person.
Most policies explicitly prohibit supervisors and coworkers from providing unofficial references and instruct them to redirect all inquiries to HR immediately. Violating this directive typically results in disciplinary action, because one off-the-cuff comment about a former colleague’s work ethic can create liability the company never authorized.
There’s an important distinction between a professional reference provided on behalf of the company and a personal reference someone gives as an individual. A manager who writes a LinkedIn recommendation or speaks informally about a former employee’s character is generally acting in a personal capacity, not as a company spokesperson. Policies should make this distinction explicit, because the legal protections that apply to official company communications, including qualified privilege and statutory immunity, may not extend to a supervisor’s personal comments.
Consent and Verifying the Requester
Before releasing any information beyond a basic employment confirmation, the company needs documentation from both sides of the transaction. The requesting party should submit a written inquiry identifying who they are, which organization they represent, and why they need the information. Verification staff review these details to confirm the request comes from a legitimate source, such as a prospective employer or licensed lending institution.
The critical piece is a signed release from the current or former employee authorizing the disclosure. This consent form should specify exactly which records the employee permits the company to share and the time period covered. If someone worked at the company for fifteen years but only wants references covering their last five, the paperwork needs to reflect that boundary. The employee’s signature and the date of authorization establish that the consent was current and voluntary.
Administrative staff should cross-reference the consent form against identification records to prevent someone from requesting another person’s employment data fraudulently. Many organizations use standardized templates from professional HR associations to ensure all required fields are present. Once everything checks out, the file is cleared for release.
How to Send and Log the Response
After authorization is confirmed, the actual transmission should happen through secure channels. Many organizations use encrypted email or third-party verification platforms like The Work Number, which allows credentialed verifiers to access encrypted employment and income data around the clock.1The Work Number. How It Works Standard mail with tracked delivery remains an option when the recipient requires original signatures or corporate letterhead. Whatever the method, using a tracked channel creates a verifiable record of exactly when and how the information was delivered.
The responding officer should log every transaction in the employee’s permanent personnel file. The log should capture the date of the response, the recipient’s identity, and a copy of exactly what was transmitted. This documentation becomes essential if a dispute later arises about what the company actually said. Most organizations set an internal deadline for completing reference responses, commonly three to five business days from receipt of a complete request.
The Three Legal Risks a Policy Has to Balance
Employers face legal exposure from three directions when providing references, and the risks cut against each other in ways that make policy design genuinely tricky. Understanding all three is the only way to craft a policy that doesn’t overcorrect in one direction and create liability in another.
Defamation
A former employee can sue for defamation if the company communicates false information that damages their career. The claim generally requires showing that the employer made a false statement of fact, communicated it to at least one other person, knew or should have known it was false, and that the employee suffered harm as a result. In most states, certain categories of statements are considered defamatory per se, meaning harm is legally presumed. Claiming that a former employee committed a crime or lacks basic competence in their profession falls into this category, and the employee doesn’t need to prove lost job offers or income to recover damages.
This risk is what drives most companies toward neutral references. Sticking to dates and titles is essentially bulletproof against defamation claims because there’s nothing subjective to dispute.
Retaliation
Federal law prohibits employers from retaliating against anyone who has filed a discrimination charge, testified in an investigation, or otherwise participated in enforcement proceedings under anti-discrimination statutes.2Office of the Law Revision Counsel. 42 U.S. Code 2000e-3 – Other Unlawful Employment Practices That protection doesn’t expire when the person leaves the company. The EEOC has specifically identified negative job references as a form of unlawful retaliation when they’re motivated by the employee’s prior protected activity.3U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Retaliation and Related Issues
A negative reference isn’t automatically retaliation. Honest assessments of job performance remain lawful even if they’re unflattering, as long as the employer can show the negative statements were truthful and consistent with how it evaluates all former employees.
Negligent Referral
Here’s the risk that cuts the other direction. If a company provides a glowing reference, or stays strategically silent, about someone it knows engaged in dangerous behavior like workplace violence or sexual harassment, and that person harms someone at their next job, the referring employer can face liability for negligent referral. Courts have held that once an employer chooses to speak about a former employee, it owes a duty of care regarding both what it says and what it omits. That duty can extend to foreseeable victims at the new workplace when serious safety concerns are involved.
This tension sits at the heart of every reference policy. Say too much and risk defamation. Say too little about a genuinely dangerous person and risk negligent referral. The neutral reference approach threads the needle by saying nothing at all, but even silence has limits when a former employee poses a known physical risk to others.
Protections the Policy Can Rely On
Two legal doctrines help protect employers who provide references honestly and in good faith, and understanding them is key to moving beyond the reflexive name-rank-and-serial-number approach.
The first is qualified privilege, a common-law protection that applies when a communication is made in good faith, concerns a subject where the speaker has a legitimate interest or duty, and is directed to someone with a corresponding interest. A former employer responding to a hiring manager’s reference check fits neatly into this framework. The privilege is qualified rather than absolute because it disappears if the employer acts with malice or reckless disregard for the truth.
The second protection is statutory. Over 30 states have enacted reference immunity laws that create a presumption of good faith when employers share truthful information about a former employee’s job performance. Under most of these statutes, a former employee challenging the reference must overcome that presumption with clear and convincing evidence, showing that the information was knowingly false, deliberately misleading, or disclosed with malicious intent. That’s a demanding standard, and the laws are designed to encourage employers to share meaningful performance data rather than retreat behind a minimal disclosure policy.
These protections are significant but not unlimited. Immunity typically doesn’t apply if the disclosed information violates a nondisclosure agreement or confidentiality rules. Some courts have also questioned whether statutory immunity shields employers from third-party negligent referral claims, as opposed to defamation suits from former employees. Companies that choose to share more than dates and titles should document that the information was accurate, job-related, and provided in response to a legitimate request.
When the Fair Credit Reporting Act Applies
When a company uses a third-party agency to compile or verify a reference rather than handling the inquiry directly, the Fair Credit Reporting Act enters the picture. The FCRA defines a “consumer report” broadly enough to cover any communication by a consumer reporting agency that bears on a person’s character, reputation, or personal characteristics when used for employment purposes.4Office of the Law Revision Counsel. 15 U.S. Code 1681a – Definitions; Rules of Construction Many companies outsource verification to services that function as consumer reporting agencies under the statute.
The FCRA imposes a specific sequence of obligations on employers who use these agencies:
- Before ordering the report, the employer must give the applicant a written disclosure, in a standalone document, that a consumer report may be obtained for employment purposes, and the applicant must authorize the report in writing.5Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
- Before taking adverse action, if the report influences a decision not to hire, the employer must give the applicant a copy of the report and a summary of their rights under the FCRA before finalizing that decision.6Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
- After taking adverse action, the employer must notify the applicant of the decision, identify the reporting agency by name and contact information, state that the agency did not make the hiring decision, and inform the applicant of their right to dispute inaccuracies and obtain an additional free copy of the report within 60 days.7Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
Skipping any step exposes the employer to FCRA liability. The standalone disclosure requirement trips up many companies, because burying the notice inside an employment application violates the statute.8U.S. Equal Employment Opportunity Commission. Background Checks: What Employers Need to Know Your internal policy should explicitly address FCRA compliance whenever a third-party verification service is involved.
Record Retention
Federal regulations require employers to preserve personnel and employment records for at least one year from the date the record was created or the personnel action occurred, whichever is later.9GovInfo. 29 CFR 1602.14 – Preservation of Records Made or Kept For involuntarily terminated employees, the one-year clock starts from the date of termination rather than the date the records were created.
If an EEOC charge has been filed, the retention obligation extends until the charge and any resulting litigation are fully resolved, regardless of how long that takes.10U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements Reference response logs, including copies of what was sent, to whom, and when, fall squarely within the scope of personnel records. Companies should retain them for at least one year, and longer whenever there’s any indication of a pending complaint. Many organizations default to retaining reference logs for the same period as the underlying personnel file, which often exceeds the federal minimum by several years.
Service Letter States
A small number of states go beyond the voluntary reference framework and require employers to provide a written statement explaining the reason for an employee’s departure. These service letter laws are triggered when a former employee submits a formal written request, and they typically give the employer between 10 and 15 days to respond. The required content varies. Some states mandate only a truthful reason for discharge, while others require details about the employee’s job duties, length of service, and pay rate.
These laws exist in only a handful of states, and the specific requirements differ enough that companies operating in multiple locations need to check local rules. Failing to respond within the statutory deadline can result in penalties, so HR teams should flag incoming service letter requests for priority handling and treat them differently from routine reference inquiries.