Human Resource Blog

Security parameters for personnel files in HR offices

In order to make sure our company is in compliance, are there any regualtions regarding the security requirements for personnel records in the Human Resources office?

Is a locked file cabinet okay?

What room security is prudent?

Thanks,
Barry

There are no federal regulations (and few if any state regulations) regarding how HR files are stored. However, there are some best practices in the industry.

Different states have laws regarding the security of personnel records. For example, in Texas the employer cannot disclose the employees social security number to anyone outside the company — not even a third party payroll processor. However, these laws seldom go into detail about how to achieve that security.

Personnel files should be kept in a file cabinet that is locked, preferably all the time. The cabinet should be in an office that is locked when not in use. Employees should be careful not to leave files unsecured. For example, a personnel file should be locked inside a desk or cabinet, rather than left on the desk, when a supervisor or HR pro goes to lunch.

The primary federal law regarding privacy of files is the ADA, the Americans with Disabilities Act, which requires that employers maintain a confidential file separate from the personnel file.  The confidential file contains any and all medical information on the employee including doctors notes, FMLA forms, etc. Many employers also keep other sensitive information, such as the employees credit report or background check, in this file. The confidential file must be kept in a locked location where even the employees supervisor does not have access to it regularly, to prevent discrimination based on disability or medical information. So the best practice is to keep this information in a separate file cabinet, with a different key, from the personnel files. Some employers even keep them in a different location.