HR Document Retention Policy: Complete Guide to Personnel Records Management

Why HR Document Retention is Different

HR records face unique retention challenges compared to other business documents:

Multiple Overlapping Requirements:

• Federal laws (FLSA, FMLA, ADA, ADEA, Title VII, ERISA, OSHA)
• State employment laws (often longer than federal)
• Agency regulations (EEOC, DOL, IRS, ICE)
• Industry-specific rules (government contractors, healthcare)

Varied Trigger Events:

• Some periods run from document creation
• Others from employee termination
• Still others from plan year end or benefit eligibility

Segregation Requirements:

• Medical records must be separate from personnel files
• I-9s must be separate from both
• Different access controls for different record types

Litigation Holds:

• Employment lawsuits can require extended retention
• Discovery obligations override normal destruction schedules
• Class action exposure multiplies risk

Penalties for Non-Compliance:

HR Document Retention Requirements by Category

Personnel Files

The core employee personnel file contains employment history, performance, and administrative records. Requirements come primarily from Title VII, ADEA, and ADA.

Personnel File Contents:

Best Practice Retention: Retain complete personnel files for 7 years after termination to cover most statute of limitations periods for employment claims.

What NOT to Include in Personnel Files:

• Medical records (separate file required)
• I-9 forms (separate file required)
• Background check reports (limited access)
• Investigation files (confidential)
• Garnishment orders (payroll file)
• Immigration documents (separate)

I-9 Employment Eligibility Verification

I-9 retention has specific requirements under the Immigration Reform and Control Act (IRCA) and is actively enforced by Immigration and Customs Enforcement (ICE).

I-9 Retention Rule:

Retain I-9 for the LONGER of:
- 3 years from date of hire, OR
- 1 year after termination date

Formula: MAX(Hire Date + 3 years, Termination Date + 1 year)

I-9 Retention Examples:

Critical I-9 Requirements:

• Store I-9s separately from personnel files (allows efficient audit response)
• Organize by status: active employees, terminated employees, reverification needed
• Never store copies of identity documents (creates over-documentation risk)
• E-Verify records retained separately with same timeline
• Document any corrections with date and initials

Audit Preparation: When ICE issues a Notice of Inspection, you have 3 business days to produce I-9s. Separate storage enables rapid response without exposing entire personnel files.

Payroll and Tax Records

Multiple agencies require payroll record retention: IRS, DOL, and state tax authorities.

Federal Payroll Requirements:

Payroll Record Details Required by FLSA:

For non-exempt employees, maintain:

• Employee name, address, date of birth (if under 19), sex, occupation
• Time and day workweek begins
• Regular hourly rate
• Hours worked each day and each workweek
• Total daily or weekly straight-time earnings
• Total overtime compensation for the workweek
• Additions to or deductions from wages each pay period
• Total wages paid each pay period
• Date of payment and pay period covered

Exempt Employee Records:

For exempt employees, maintain:

• Basis of pay (weekly, monthly salary amount)
• Total compensation per pay period
• Date of payment and pay period covered

State Variations: California, New York, and other states require longer retention periods (6-7 years) or additional records. Always apply the longer period when federal and state requirements differ.

Benefits and ERISA Records

Employee benefits create extensive retention obligations under ERISA, COBRA, HIPAA, and the Affordable Care Act.

ERISA Plan Records:

COBRA Records:

HIPAA Records (Health Plan):

ACA Records:

Medical and ADA Records

Medical records require special handling under ADA, GINA, and HIPAA. These must be stored separately from personnel files with restricted access.

Medical File Contents:

ADA Confidentiality Requirements:

Medical information must be:

• Stored in separate, locked files
• Accessible only to those with legitimate need
• Not used for discriminatory purposes
• Disclosed only when legally required

Who May Access Medical Files:

Recruitment and Applicant Records

Recruitment records create liability under Title VII, ADEA, ADA, and state anti-discrimination laws. The EEOC requires retention for audit and charge investigation purposes.

Applicant Record Requirements:

Federal Contractor Additional Requirements (OFCCP):

Background Check Records (FCRA):

• Consumer reports: Destroy after hiring decision (do not retain in personnel file)
• Adverse action documentation: 2 years minimum
• Authorization forms: Duration + 5 years
• Pre-adverse action notices: 2 years

State Ban-the-Box Considerations: Many states restrict when background checks can be conducted and how records are used. Document compliance with timing requirements.

Training and Development Records

Training records support compliance demonstrations and performance documentation.

Required Training Records:

Training Record Components:

For each training session, document:

• Employee name and ID
• Training topic and content summary
• Training date and duration
• Training delivery method (in-person, online, etc.)
• Trainer/provider name
• Assessment/quiz results if applicable
• Employee acknowledgment/signature
• Certificate of completion if issued

Workplace Safety Records (OSHA)

OSHA requires specific record retention for workplace injuries, illnesses, and safety programs.

OSHA Recordkeeping Requirements:

Post-Termination Exposure Records: For employees exposed to toxic substances or hazardous agents, medical and exposure records must be retained for 30 years after termination—one of the longest HR retention requirements.

Disciplinary and Termination Records

Disciplinary and termination records are crucial for defending wrongful termination, discrimination, and retaliation claims.

Disciplinary Record Retention:

Why 7 Years Post-Termination:

• Covers most state statute of limitations for employment claims
• Addresses delayed-filing scenarios for discrimination charges
• Provides documentation if former employee files suit
• Supports unemployment claim responses

Investigation File Retention:

Investigation files (harassment, discrimination, theft, policy violations) should be:

• Stored separately from personnel files
• Retained for duration + 7 years minimum
• Subject to litigation holds when claims filed
• Accessible only to HR, legal, and investigators

Building Your HR Retention Schedule

Step 1: Inventory All HR Record Types

Create a comprehensive inventory of every HR document type in your organization:

Inventory Template:

Step 2: Determine Applicable Requirements

For each record type, identify all applicable regulations:

Requirement Matrix:

Rule of Thumb: When requirements conflict, apply the longest retention period.

Step 3: Create Retention Schedule

Sample HR Retention Schedule:

Step 4: Establish Destruction Procedures

Destruction Methods by Record Type:

Physical Records:

• Cross-cut shredding (minimum DIN P-4 security level)
• Incineration for highly sensitive records
• Certificate of destruction from vendor
• Witnessed destruction for confidential materials

Electronic Records:

• Secure deletion with overwrite
• Cryptographic erasure for encrypted data
• Physical destruction of storage media if required
• Audit trail of deletion activities

Destruction Documentation:

For each destruction event, record:

• Date of destruction
• Record types destroyed
• Retention period satisfied
• Destruction method used
• Witness name (if applicable)
• Authorization signature

Destruction Log Template:

File Organization and Storage

Physical File Structure

Recommended Physical File Organization:

File Type 1: Personnel Files (Main)

• Organized alphabetically by last name
• Active and terminated employees separated
• Terminated files moved to archive storage after 1 year
• File folder with standard sections

Personnel File Sections:

1. Employment (application, offer, contract)
2. Compensation (salary history, increases)
3. Performance (reviews, goals, feedback)
4. Training (completions, certifications)
5. Disciplinary (warnings, PIPs)
6. Administrative (acknowledgments, changes)

File Type 2: Medical Files (Separate)

• Locked storage, separate from personnel
• Access log maintained
• Organized alphabetically
• Includes ADA, FMLA, WC, drug tests

File Type 3: I-9 Files (Separate)

• Section 1: Active employees (by hire date for audit)
• Section 2: Terminated employees (by destruction date)
• Section 3: Reverification pending

File Type 4: Investigation Files (Confidential)

• Locked, restricted access
• Organized by case number
• Separate from personnel and medical

Electronic Records Management

HRIS Record Organization:

Most modern HRIS systems support document management:

• Configure retention rules by document type
• Set up automated destruction reminders
• Implement access controls by role
• Enable audit logging for document access

Electronic Storage Requirements:

Cloud Storage Considerations:

• Ensure vendor retention policy alignment
• Verify data residency compliance
• Confirm deletion is truly permanent
• Document business associate agreements (for medical)

Access Controls

Access Matrix by Role:

Access Logging Requirements:

For medical and investigation files, log:

• Who accessed the record
• Date and time of access
• Purpose of access
• Any documents viewed or copied

Litigation Holds and Legal Considerations

Understanding Litigation Holds

A litigation hold suspends normal document retention when litigation is reasonably anticipated. Failure to preserve relevant documents creates spoliation liability.

Litigation Hold Triggers:

Litigation Hold Process:

1. Identify Trigger: Legal or HR recognizes preservation duty
2. Assess Scope: Determine affected employees, date ranges, record types
3. Issue Hold Notice: Written notice to all custodians
4. Suspend Destruction: Stop scheduled deletions for affected records
5. Confirm Compliance: Document acknowledgments from custodians
6. Monitor: Ensure ongoing preservation
7. Release Hold: Written notice when litigation concludes

Hold Notice Contents:

• Matter description (case name, charge number)
• Preservation obligation explanation
• Records to preserve (be specific)
• Time period covered
• Prohibition on deletion, alteration, or destruction
• Contact for questions
• Acknowledgment requirement

State-Specific Requirements

State laws often impose longer retention requirements than federal law.

California HR Retention:

New York HR Retention:

Texas, Florida, and Other States: Many states default to federal requirements but may have specific rules for:

• Unemployment compensation records
• Workers' compensation records
• State tax withholding records
• State-specific leave programs

Multi-State Employers:

• Apply the longest retention period across all states where you have employees
• Or maintain state-specific schedules if volume justifies complexity
• Document which retention standard applies to each location

Audit Preparation and Compliance

Self-Audit Program

Conduct regular internal audits to identify compliance gaps before regulators find them.

Quarterly Self-Audit Checklist:

I-9 Audit (10% sample minimum):

• Section 1 completed by first day of work
• Section 2 completed within 3 business days
• Acceptable documents properly recorded
• No over-documentation (copies of documents)
• Reverifications completed before expiration
• Terminated employee I-9s properly retained

Personnel File Audit (5% sample):

• Required documents present (application, offer, acknowledgments)
• No prohibited documents (medical, I-9, investigation)
• Performance reviews on schedule
• Disciplinary documentation complete
• Termination documentation complete (for termed employees)

Payroll Record Audit:

• Time records complete for non-exempt employees
• Overtime calculated correctly
• Required deductions documented
• W-4 forms current
• Pay stubs meet state requirements

Medical File Audit:

• Files stored separately from personnel
• Access limited to authorized personnel
• FMLA certifications complete
• ADA accommodations documented
• Drug test results properly maintained

Responding to External Audits

Common HR Audits:

Audit Response Protocol:

1. Receive Notice: Document date received, deadline, scope
2. Notify Leadership: Alert legal, HR leadership, affected managers
3. Preserve Records: Issue litigation hold if not already in place
4. Assess Scope: Determine what records are requested
5. Gather Documents: Pull requested records, review for completeness
6. Legal Review: Have counsel review before submission
7. Submit Response: Meet deadline with organized, indexed materials
8. Document Process: Maintain record of response for future reference

Common Audit Findings and Remediation

Frequent I-9 Issues:

Frequent Payroll Issues:

Frequent Personnel File Issues:

Technology and Automation

HR Document Management Systems

Modern HRIS and document management systems automate retention compliance.

Key Features for Retention Compliance:

Popular HRIS Platforms with Document Management:

Implementing Retention Automation

Phase 1: Configuration (Month 1)

• Map document types to system categories
• Configure retention periods by category
• Set up access controls
• Enable audit logging

Phase 2: Migration (Months 2-3)

• Scan and upload physical documents
• Assign retention metadata
• Organize by employee and category
• Validate completeness

Phase 3: Process Integration (Month 4)

• Train HR staff on new workflows
• Update procedures for document creation
• Implement destruction review process
• Test litigation hold functionality

Phase 4: Ongoing Management

• Monthly destruction review and approval
• Quarterly compliance reporting
• Annual retention schedule review
• System audit and optimization

Policy Template Components

HR Document Retention Policy Structure

Section 1: Purpose and Scope

• Policy objectives
• Covered employees and records
• Geographic and legal scope
• Relationship to other policies

Section 2: Definitions

• Personnel records
• Medical records
• Confidential records
• Retention period
• Destruction
• Litigation hold

Section 3: Roles and Responsibilities

• HR department responsibilities
• Manager responsibilities
• Employee responsibilities
• Legal department role
• Records management role

Section 4: Retention Schedule

• Complete schedule by record type
• Retention periods and triggers
• Legal basis citations
• Review frequency

Section 5: Storage Requirements

• Physical storage standards
• Electronic storage standards
• Segregation requirements
• Access controls
• Security measures

Section 6: Destruction Procedures

• Authorized destruction methods
• Approval requirements
• Documentation requirements
• Destruction log maintenance
• Vendor requirements

Section 7: Litigation Holds

• Hold triggers
• Hold process
• Custodian responsibilities
• Hold release procedures

Section 8: Compliance and Auditing

• Self-audit schedule
• External audit response
• Violation consequences
• Policy review schedule

Section 9: Exceptions

• Exception request process
• Approval authority
• Documentation requirements

Implementation Roadmap

Phase 1: Assessment (Weeks 1-2)

Activities:

• Inventory current HR records and storage
• Identify all applicable legal requirements
• Assess current retention practices
• Gap analysis against requirements

Deliverables:

• Complete record inventory
• Requirement matrix
• Gap analysis report
• Risk assessment

Phase 2: Policy Development (Weeks 3-4)

Activities:

• Draft retention schedule
• Develop retention policy
• Create destruction procedures
• Establish access controls

Deliverables:

• Draft retention policy
• Complete retention schedule
• Destruction procedure documentation
• Access control matrix

Phase 3: Infrastructure (Weeks 5-8)

Activities:

• Configure HRIS retention settings
• Reorganize physical files
• Implement file segregation
• Set up destruction workflow

Deliverables:

• Configured document management
• Reorganized file storage
• Segregated medical/I-9 files
• Tested destruction process

Phase 4: Training and Rollout (Weeks 9-10)

Activities:

• Train HR staff
• Brief managers on access
• Communicate employee rights
• Launch new procedures

Deliverables:

• Trained HR team
• Manager briefing materials
• Employee communication
• Go-live confirmation

Phase 5: Ongoing Operations

Monthly:

• Destruction review and approval
• New hire file setup
• Termination file processing

Quarterly:

• Self-audit (sample)
• Compliance reporting
• Exception review

Annually:

• Full policy review
• Retention schedule update
• Training refresh
• Comprehensive audit

Conclusion

HR document retention is complex, but the consequences of non-compliance are severe. A well-designed retention program protects your organization legally, reduces storage costs, enables efficient audit response, and demonstrates organizational maturity.

Your HR Document Retention Checklist:

• Complete inventory of all HR record types
• Identify applicable federal, state, and industry requirements
• Create comprehensive retention schedule
• Separate medical files from personnel files
• Separate I-9 files from personnel files
• Implement access controls by record type
• Establish secure destruction procedures
• Create litigation hold process
• Train HR staff on retention requirements
• Implement regular self-audit program
• Configure HRIS for automated retention

Related Resources:

• HR Policy & Compliance Center - Complete HR resource hub
• HR Compliance Templates - I-9, FMLA, ADA, wage/hour templates
• Data Retention Policy Guide - Broader organizational data retention
• Performance Review Cycle Guide - Performance documentation best practices

Build a retention program that keeps you audit-ready and protects your organization from the substantial penalties associated with HR record mismanagement.