Should any controls be placed on employee access to personnel files?

Companies need to provide both employees and managers with access to information contained in personnel files, while at the same time insuring that the information contained in the files is properly safeguarded.

Typically, information contained in a personnel file might include such confidential information as performance appraisals, salary, disciplinary records, pre-employment records (such as letters of reference and test scores), medical records, and investigatory records (such as credit reports, background checks, and criminal records).

Access to personnel information --either by employees, other organization members, or by outside parties --should be viewed as a control issue. A specific policy should designate a custodian for personnel records and explain the requirements for access to personnel records. Putting a system or procedure into place to safeguard access to personnel information will help a company in any legal proceedings that allege improper handling of information that is personal to employees.

Considerations for personnel file access policies

An employer implementing a policy governing access to personnel information should:

State what information is to be collected about employees. Such information should be related to a legitimate business purpose. The policy may subdivide information into two different files --one file for routine and non-private information, and another file that contains sensitive and highly confidential documents.
Identify what information an employee can access and how often. Because the rules covering an employee's access to his or her own personnel records are generally governed by state law, it is important for employers to familiarize themselves with applicable state law. The method of access to personnel records varies from state to state, as do the rules governing frequency of access. The scope of personnel records that an employee is allowed to inspect also varies by state. Be sure to check State Laws for the laws that apply in your state(s).
Determine whether an employee may take copies of certain information or examine it only in private during business hours.
Determine when, where, and under what circumstances an employee may review his or her personnel file, including what notice must be given to the employer, how the request is to be made (such as in writing), and how long after termination an employee has the right to request access to the file.
Decide whether employees have the right to challenge or correct information in the file.
Determine what information will be disclosed or verified to prospective future employers upon a reference inquiry and whether the employee has the right to authorize release of certain information.

People with access

Persons other than the employee who may have access to personnel information should be able to demonstrate a legitimate business need for access. There should be a stated reason for access and information in the files should not be selectively purged depending on who is seeking access to the information. Those who may obtain access to personnel information typically come from one of two categories:

Persons employed by or assisting the company --members of the human resources, benefits, or payroll departments, employee supervisors or managers, a high level company officer with an official company need, or an attorney or consultant advising the company; and
Third parties from outside the company --representatives of government compliance agencies (their access should be limited to the claim or violation being investigated), law enforcement officers with a subpoena, and business or union agents pursuing employee grievances.