HR records management is the discipline of collecting, separating, storing, and eventually destroying every document tied to an employee, from application through final separation, in a way that satisfies at least five federal agencies with overlapping and non-identical rules. Done well, it protects the organization in audits and lawsuits. Done poorly, it invites fines that stack per form or per employee, and evidentiary losses that can decide a case before it starts.
Separate the Files Before You Store Anything
Federal law treats certain document categories as sensitive enough that they cannot share a folder with the general personnel file. Getting the separation right at intake is easier than untangling it later.
The core personnel file holds the career arc: application, offer letter, signed policy acknowledgments, evaluations, discipline, and promotion history. The EEOC treats these broadly as “personnel or employment records” for retention purposes.
Payroll records belong in their own structure because they answer to different auditors. The FLSA requires each worker’s full name, address, Social Security number, hourly rate, hours worked each workweek, and total wages paid each pay period, among other data.1U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act The IRS imposes a separate, overlapping requirement for employment tax records covering wage amounts, deposit dates, and W-4 copies.2Internal Revenue Service. Publication 15, Employers Tax Guide Keeping payroll apart makes it easier to answer a wage audit without exposing unrelated personnel information.
Form I-9 is required for every person hired after November 6, 1986.3Immigration and Customs Enforcement. Form I-9 Inspection Under Immigration and Nationality Act 274A No statute technically requires separate storage, but employers must produce I-9s within three business days of an inspection request from DHS, DOJ, or DOL officers.4U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 Pulling them from hundreds of individual folders on that timeline is a losing exercise, so nearly every employer stores them together.
Medical and genetic information is different: separation is a hard legal mandate. ADA regulations at 29 CFR 1630.14 require that medical information be collected on separate forms, stored in separate files, and treated as confidential medical records.5eCFR. 29 CFR 1630.14 – Medical Examinations and Inquiries Specifically Permitted GINA imposes a parallel rule for genetic information. The category covers health insurance enrollment forms, doctor’s notes, workers’ compensation claims, drug test results, and accommodation documentation.
A boundary worth naming: HIPAA does not drive this separation. HHS has stated that HIPAA’s Privacy Rule does not protect employment records, even when the information is health-related.6U.S. Department of Health and Human Services. Employers and Health Information in the Workplace The ADA and GINA are what require the walls, and a manager who merely sees medical details while reviewing an unrelated file can create liability even without acting on the information.
Benefit plan records form their own category if the organization offers an ERISA-covered plan. ERISA Section 107 requires plan administrators to maintain records supporting required filings for at least six years after the filing date.7Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records Documents showing how individual benefits were calculated should be held longer, until benefits are paid out and audit windows close.
Federal Retention Timelines
Different agencies enforce different periods, and they rarely line up cleanly. The workable rule is to track each document type against the longest requirement that touches it.
- Payroll records under the FLSA: at least three years for core payroll data including names, addresses, hours, and total wages paid each pay period.1U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
- Supplemental FLSA wage records: at least two years for timecards, work schedules, wage rate tables, and records of additions to or deductions from wages.1U.S. Department of Labor. Fact Sheet 21 – Recordkeeping Requirements Under the Fair Labor Standards Act
- IRS employment tax records: at least four years after the tax becomes due or is paid, whichever is later.8Internal Revenue Service. How Long Should I Keep Records
- EEOC personnel and employment records: one year from the date the record was made or the personnel action occurred, whichever is later; for involuntary terminations, one year from the termination date.9U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
- Form I-9: the entire duration of employment, plus three years after the hire date or one year after termination, whichever is later.4U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9
- ERISA benefit plan records: at least six years after the filing date of the report based on those records.7Office of the Law Revision Counsel. 29 USC 1027 – Retention of Records
- OSHA employee medical records: at least the duration of employment plus 30 years. Exposure records: at least 30 years.10Occupational Safety and Health Administration. 29 CFR 1910.1020 – Access to Employee Exposure and Medical Records
OSHA’s clock is the outlier. For a long-tenured worker in a hazardous role, exposure records can sit in storage for well over half a century. These federal periods are floors. Many states impose longer requirements for particular record types, and the correct policy defaults to whichever timeline is longest.
When a Charge or Lawsuit Overrides the Schedule
The moment a discrimination charge is filed with the EEOC or a lawsuit is brought, normal retention schedules stop applying to the records involved. Every record related to the charge or action must be preserved until final disposition, meaning the deadline for the employee to sue has passed or all litigation, including appeals, has concluded.11U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
The duty to preserve begins earlier than that. Once litigation is reasonably anticipated, potentially relevant documents must be preserved. Destruction after that point is spoliation. Under Federal Rule of Civil Procedure 37, if reasonable preservation steps were not taken and electronically stored information cannot be restored, a court can order measures to cure the prejudice. Intentional destruction opens the door to the harshest sanctions, including an instruction that the jury may assume the missing records would have supported the other side.
In practice, this means issuing a litigation hold as soon as a potential claim surfaces. A litigation hold is an internal directive that suspends routine destruction for all records that could be relevant. IT, managers, and anyone with access to the affected records need to receive the hold and confirm they are complying. If employees leave or new ones join while the dispute is open, the hold has to be updated to cover their records and access.
Storing Records Securely
Retention rules are meaningless if records degrade, get breached, or reach the wrong hands.
Paper
Paper files belong in locked, fire-resistant cabinets in rooms with restricted entry. Humidity and temperature swings cause paper to degrade, ink to fade, and mold to develop. A record that is unreadable during a federal audit is functionally missing. Where retention runs 30 years, climate control is not optional.
Digital
Electronic files need encryption in transit and at rest. Multi-factor authentication limits access to authorized HR personnel. The ADA’s separation requirement carries into digital systems: folders holding health-related documents need access permissions distinct from those on personnel or payroll directories. A supervisor with legitimate access to performance reviews should not be able to click into the medical folder under the same login.
Electronic Signatures
The federal E-SIGN Act lets electronic records and signatures satisfy legal requirements that information be provided in writing, which covers most HR documents including offer letters, policy acknowledgments, and benefit elections. Before using electronic records with an employee, the employer must obtain affirmative consent after clearly disclosing the right to receive paper copies, the right to withdraw consent, and the hardware and software needed to access and retain the records. An electronic document without proper consent can be challenged as unenforceable.
Who Gets Access
No federal statute gives private-sector employees a general right to inspect their own personnel files. That right, where it exists, comes from state law, and the rules vary widely. Some states require access within a few days of a written request, others allow up to 30 days, and some have no access law at all. Many employers grant access anyway through internal policy.
For management, the standard is need-to-know. A direct supervisor reviewing performance for an annual evaluation has a legitimate reason to see performance data. That same supervisor has no reason to open the medical file. The ADA limits disclosure of medical information to three narrow situations: supervisors may be told about necessary work restrictions and accommodations, first aid personnel may be informed when a condition might require emergency treatment, and government officials investigating compliance may request relevant information.5eCFR. 29 CFR 1630.14 – Medical Examinations and Inquiries Specifically Permitted Outside those exceptions, medical records stay closed.
Government agencies reach records through audits and formal requests. The IRS may request employment tax records in an audit.12Internal Revenue Service. Audits Records Request DHS can demand I-9s on three business days’ notice.4U.S. Citizenship and Immigration Services. 10.0 Retaining Form I-9 Before releasing anything to a third party, verify the legitimacy and scope of the request. A subpoena for payroll records tied to one employee does not authorize handing over the whole department.
Disposing of Records Properly
Once a record clears its longest applicable retention period and no litigation hold applies, destroy it. Indefinite retention is its own liability, both in future litigation and in the event of a breach.
Paper must be rendered unrecoverable. Cross-cut shredding, pulverizing, or incineration all work. Intact documents in a recycling bin do not. Digital files require overwriting software that fills the freed space with random data, because standard deletion leaves recoverable traces.
The Fair and Accurate Credit Transactions Act Disposal Rule applies to any record containing information derived from a consumer report, which includes background checks used in hiring. The FTC’s rule requires disposal practices that are “reasonable and appropriate” to prevent unauthorized access, with examples including shredding papers so information cannot be read or reconstructed, and destroying or erasing electronic media so data cannot be recovered.13Federal Trade Commission. FACTA Disposal Rule Goes Into Effect June 1 The floor is active destruction, not passive discard.
Willful failure to dispose of consumer report information properly exposes the organization to liability under the Fair Credit Reporting Act. A consumer can recover actual damages or statutory damages between $100 and $1,000 per violation, plus punitive damages and attorney’s fees at the court’s discretion.14Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Multiply that across a workforce and the exposure compounds quickly.
Penalties for Recordkeeping Failures
Consequences run beyond fines, and they vary by agency.
Under the FLSA, civil monetary penalties for recordkeeping violations can reach $1,313 per violation as of the most recent inflation adjustment.15U.S. Department of Labor. Civil Money Penalty Inflation Adjustments The bigger cost usually shows up in wage disputes. When an employee claims unpaid overtime and the employer has no timecards to rebut the claim, courts routinely accept the employee’s estimates.
I-9 violations carry their own structure. Substantive paperwork errors, those suggesting the employer failed to properly verify work authorization, can result in per-form fines. Technical errors typically get correction notices, but widespread deficiencies discovered in an audit escalate quickly when multiplied across a workforce.
EEOC recordkeeping failures do not carry direct monetary penalties in the FLSA sense. The damage is indirect. If you cannot produce the hiring records, interview notes, or evaluation criteria that justify a personnel decision, you lose the ability to defend against a discrimination claim, and the missing records become the story.
The pattern is consistent across agencies. Keeping records costs relatively little. Not keeping them costs whatever the next audit, lawsuit, or investigation turns out to cost.