Is It Time to Update Your Record Retention Policies?

​Operational upheavals during the pandemic, coupled with the new emphasis on remote work, have required HR professionals to change how they handle and where they store employment records. Now is a good time to review your organization’s policies and practices on record retention to ensure they comply with federal, state and local requirements. 

For the solo HR practitioner, this can be a herculean task. Here are some tips to help you through it.

Create a Schedule

“HR should have at hand and periodically update a chart for each type of record to be retained, the primary custodian, the retention period, and the law or regulation that governs how long to retain that particular record,” says Susan Kline, a partner with the law firm Faegre Drinker in Indianapolis.

Carol Kardas, SHRM-SCP, founding partner of KardasLarson LLC, a Connecticut-based HR consulting company, suggests setting retention periods for the longest time required when documents are governed by more than one law. She also advises employers to keep all records related to pending litigation until the issue has been resolved.

Restrict Access

It’s important to limit access to employee records to those who have a legitimate need to know the information or are legally required to have access.

“Anticipate requests for personnel file reviews from current or former employees, and have a consistent response to avoid discrimination claims,” Kline says.

To prepare, review the legal requirements in the states where employees work. Specify what access the company will allow in those states with no regulatory requirement. 

• Consider the following questions when establishing an access policy:
• Will both current and former employees be granted access?
• Will employees be allowed to make copies of their files?
• What is the process for employees who want to challenge what they contend is incorrect information?
  
• What limits should be set for accessing confidential information such as former employer reference checks and investigation notes?
  
• How often can employees gain access to their personnel files?

A multistate employer needs a flexible policy so it is applicable to all employees. For example, such an employer might include in its employee handbook a statement that “access to personnel files will be provided according to state law.”

Maintain Separate Files

Housing the wrong information in employee personnel files is a common mistake employers make, Kardas says. 

Record-keeping policies should designate specific locations where records will be retained, as well as the format in which the records will be maintained.

“Medical records, for example, do not go into an employee’s personnel file,” Kardas says. “They must be stored in locked file cabinets that are in different locations than personnel records.”

Kline says HR also needs to have a system in place to collect copies of supervisors’ informal performance management notes, as well as key e-mail or even text messages, to add to personnel records.

“If the information might lead to any form of adverse personnel action down the road, best practice is to make sure it gets into the individual’s personnel record in a timely manner,” she explains, “and that can be challenging for electronic communications.” 

Make sure managers know there is no such thing as a personal file when it comes to notes they’ve made about employees they supervise. 

“Any such records are business records of the organization and subject to discovery,” Kline says.

The following types of records should be included in employee personnel files:

Pre-employment documents. These can include job descriptions; job applications or resumes; offer letters; signed acknowledgments of receipt of and agreement with the company’s employee handbook, code of conduct and other key policies; and emergency notification forms.

Employment documentation. This includes records related to job performance and awards or citations for excellence, promotions and transfers, compensation, attendance records and attendance or tardiness notes, training program completions, warnings and any formal discipline, and any contract or written agreement between the employee and the employer.

Separation of employment documents. These include exit interviews, separation checklists, notes about the reason for separation, resignation letters, unemployment documents, separation agreements, correspondence and reference statements.

Other types of records should be kept in separate locations. These include credit information, immigration forms and documents related to complaints, investigations and lawsuits. 

“I-9 forms should be stored in alphabetical order in three-ring binders that are locked in file storage,” Kardas says. “If you’re storing them online, work with IT to store them on separate servers from other personnel records and make sure they are in a printable format that can replicate the exact government hard copy—down to the color of the ink used on the original form.”

Go Electronic

Records management presents a great business case for investing in a good human resource information system, Kardas says.

“There are some very good HR information systems that can track and keep employee records updated, particularly in the recruiting, hiring and onboarding phases of the employment life cycle, to help ensure a company stays compliant,” she says.

Kardas also recommends outsourcing administration and records management for Family and Medical Leave Act, COBRA and unemployment cases because it’s hard for solo HR practitioners to keep up with and adhere to all the record-keeping nuances of these programs. 

However, it’s important to note that HR is responsible for ensuring that third-party providers manage records properly, retain them and make them accessible to employees.

Electronic records provide greater accessibility to information and reduce the need for physical storage space. A cloud-based or software-as-a-service approach allows companies to implement new processes faster, update software with greater ease and remove tech support burdens from HR.

On the other hand, private on-premises systems offer more control in determining how to use, store and locate data.

A records management program should provide the physical security of both hard-copy and electronic records to ensure confidentiality and protect employee privacy.

“With so much remote work, it’s become increasingly important to communicate expectations to HR professionals and people leaders about working offline with confidential personnel documents,” Kline notes.

She adds that in e-mail retention, communication and consistency are key. “Employees must be aware when correspondence will no longer be accessible, at least without going into data archives,” she says. “To avoid being accused of spoliation of evidence in legal action, the retention protocol must be followed consistently and according to the authorized procedure.”

Kline also says organizations need a procedure for suspending the standard deletion practice to retain any correspondence that could be relevant to a pending or threatened legal action.

Purge and Improve

A company’s records management policy should include ways to destroy each type of record to ensure no confidential information is revealed. In addition, the policy should outline the auditing procedures for the record retention policy and practices to ensure that internal requirements are being followed correctly.

“As retention methods change,” Kline says, “consider periodic audits based on the [updated] master records retention chart to ensure that, if needed, all required records can be accessed promptly for a selected sample of applicants and current and former employees.”  

Theresa Minton-Eversole is a writer based in Alexandria, Va.

Image by iStock.