Employee records management software stores, segregates and retains the documents in an employee file according to the rules that govern each one. There is no single retention period for a personnel file. Federal rules alone set clocks of one, three, five, six and thirty years, and some of those documents may not sit in the personnel file at all.
Ask an HR system what it holds for a given employee and you usually get one answer: a record, with documents attached. Ask what the retention rule is for that record and the question stops making sense, because the file is not one thing. The offer letter, the I-9, the timecards, the FMLA certification, the workplace injury log and the retirement plan data are governed by six different authorities, on six different clocks, with two of them legally required to live somewhere else entirely.
That mismatch is the actual compliance problem in employee records, and it is why so many HR teams end up keeping everything forever. Keeping everything is not a safe default. It expands what has to be produced in a discovery request, extends the exposure of medical and genetic information the law expects to be restricted, and makes a records request harder to answer accurately, not easier.
This guide covers the retention clocks that apply, the documents that must be segregated, where HIPAA really does and does not apply to employee data, the state rules that override the federal floor, and the requirements those rules place on whatever system you buy. It is written for the two people who have to agree on the answer: the HR leader who owns the obligation and the IT leader who has to implement it.
Why One Employee File Cannot Have One Retention Rule
Different documents in the same file are governed by different statutes, each with its own period and its own trigger event. Some clocks start at creation, some at the personnel action, some at hire, some at termination, and one runs for thirty years after employment ends. A single retention setting applied to the whole record will be wrong for most of it.
The clocks do not merely differ in length. They differ in what starts them. Equal employment records run from the making of the record or the personnel action, whichever is later. The I-9 runs from hire or from termination, whichever produces the later date. Occupational medical records run from the end of employment. Benefit plan records run from a filing date. A system that stores one retention date per employee cannot express any of that.
They also differ in what suspends them. When a discrimination charge is filed, the obligation changes from a fixed period to an open one, and it stays open until the matter is finally disposed of. That is a legal hold, applied to a defined population, and it has to be provable after the fact.
The Federal Retention Clocks and What Starts Them
The federal floor is shorter than most HR teams assume. Personnel records under Title VII run one year. Payroll records run three years under both the FLSA and the ADEA, with supporting records at two. Injury records run five years. Benefit plan records run six. Occupational medical and exposure records run thirty.
Personnel and employment records, one year. 29 CFR 1602.14 requires personnel or employment records to be preserved for one year from the making of the record or the personnel action involved, whichever occurs later, and for one year from the date of termination in the case of an involuntary termination. Where a charge of discrimination has been filed under Title VII, the ADA or GINA, the employer must preserve all personnel records relevant to the charge until final disposition. The baseline is one year, not the three or five years commonly quoted.
Payroll records, three years, with supporting records at two. Under 29 CFR 516.5 the FLSA requires payroll records to be preserved for at least three years, while 29 CFR 516.6 sets two years for supplementary basic records, the category that covers time cards, wage rate tables and work schedules. The ADEA imposes a parallel three year rule on payroll records at 29 CFR 1627.3, along with a one year rule for applications, promotion and discharge records and test papers.
Form I-9, three years or one year, whichever is later. 8 CFR 274a.2 requires the form to be retained for three years after the date of hire or one year after the date employment is terminated, whichever is later. For a long tenured employee that resolves to one year after separation. For someone who leaves inside the first two years it resolves to three years from hire. Getting this wrong in either direction is a documented audit finding, and the calculation cannot be done with a fixed period.
FMLA records, three years. 29 CFR 825.500 requires FMLA records to be kept for no less than three years and made available to the Department of Labor on request.
Injury and illness records, five years. 29 CFR 1904.33 requires the OSHA 300 Log, the privacy case list, the annual summary and the OSHA 301 incident reports to be saved for five years following the end of the calendar year the records cover.
Occupational medical and exposure records, thirty years. This is the outlier that breaks naive retention design. 29 CFR 1910.1020 requires an employee medical record to be preserved for at least the duration of employment plus thirty years, and employee exposure records for at least thirty years. The regulation carves out narrow exceptions, including health insurance claims records maintained separately from the employer medical program, first aid records for one time treatment, and the records of employees who worked less than one year where those records are given to the employee on termination.
Benefit plan records, six years, plus an open ended duty. 29 U.S.C. 1027 requires plan records to be kept available for examination for not less than six years after the filing date of the documents. Separately, 29 U.S.C. 1059 requires an employer to maintain records sufficient to determine the benefits due or which may become due to each employee. That second duty has no year count attached and is not satisfied by disposing at six years if the underlying entitlement is still live.
The Documents That Must Live Somewhere Else
Medical and genetic information may not sit in the general personnel file. The ADA, GINA and the FMLA each require that this information be kept on separate forms, in separate files, and treated as a confidential medical record. This is a storage architecture requirement, not a labelling convention.
The ADA requirement is at 29 CFR 1630.14, which states that information about the medical condition or history of an applicant, and the equivalent information about a current employee, shall be collected and maintained on separate forms and in separate medical files and be treated as a confidential medical record. GINA imposes its own parallel obligation at 29 CFR 1635.9: genetic information in writing must be maintained on forms and in medical files separate from personnel files and treated as a confidential medical record. GINA is a distinct requirement rather than a cross reference, and covers family medical history that would not otherwise register as medical data. The FMLA rule at 825.500 says the same about certifications, recertifications and medical histories created for FMLA purposes.
Read those three together and the design implication is unambiguous. An employee record needs at least two logically separate stores with different access control, not one store with a document type field and a hope that permissions were configured correctly. The people who legitimately need the offer letter and the people who legitimately need the fitness for duty certification are not the same population, and the regulation expects the system to reflect that.
It also affects the fastest path to a violation, which is the personnel file printed in response to an employee request or a subpoena. If medical certifications are stored in the same container as everything else, the person assembling the response has to remove them by hand, correctly, every time. Segregation at the storage layer removes that failure mode.
Where HIPAA Applies to Employee Records and Where It Does Not
Employment records held by a covered entity in its role as employer are excluded from the definition of protected health information. An employer holding a medical certification in a personnel file is generally not handling PHI. The exclusion is narrow: it turns on the capacity in which the organization holds the record, not on the sensitivity of the content.
This is the single most frequently misstated point in published guidance on employee records, and it matters because getting it wrong sends organizations down the wrong compliance path. The text is in the definition of protected health information at 45 CFR 160.103, which excludes individually identifiable health information in employment records held by a covered entity in its role as employer.
Two consequences follow. First, most employers holding medical certifications, fitness for duty notes and accommodation documentation are not handling PHI in those records, and the obligations that actually apply are the ADA, GINA and FMLA confidentiality rules described above, plus state law. Second, and more easily missed, a hospital or health system is a covered entity, and the exclusion depends on which hat it is wearing. The same organization can hold employment records outside HIPAA and patient records inside it, sometimes about the same person, which is exactly the case where a shared store and a single permissions model will fail.
None of this makes the information less sensitive. It changes which rulebook applies, and therefore which controls the system has to demonstrate. Our note on security and compliance covers the controls side of that.
State Rules That Sit Above the Federal Floor
Several states set retention and access rules longer or broader than the federal minimum. New York requires payroll records for six years. California extends employment record retention to four years for fair employment purposes. Illinois grants employees a statutory right to inspect and copy their own personnel records. A multi state employer inherits the longest applicable rule per record class.
New York, six years on payroll. New York Labor Law 195 requires employers to establish, maintain and preserve for not less than six years contemporaneous, true and accurate payroll records showing the required detail for each week worked. That is double the federal FLSA period and applies to any employer with New York employees.
California, four years for fair employment records. California extended the preservation period for applications, personnel, membership and employment referral records from two years to four. The California Civil Rights Department states in its own final statement of reasons for the automated decision system regulations that “extending the preservation timeline from two years to four was accomplished by statute,” referring to Senate Bill 807 of 2021 amending Government Code section 12946.
Illinois, an inspection right. The Illinois Personnel Record Review Act gives employees a statutory right, on written request, to inspect, copy and receive copies of documents used in determining their qualifications for employment, promotion, transfer, compensation, benefits or discipline, along with employment contracts, handbooks and written policies. An inspection right is a retrieval requirement in practice: the obligation is to produce a complete and correct set within a statutory window, which is a test of the system rather than of the policy.
What Changed for 2026
The newest obligations attach to automated decision making in employment. Illinois brought an artificial intelligence provision into its Human Rights Act effective 1 January 2026, including a notice duty. California folded automated decision system data into the records employers must preserve. Both changes expand what counts as an employment record.
The Illinois provision sits in the Human Rights Act at 775 ILCS 5/2-102(L), effective 1 January 2026 under Public Act 103-804. It makes it a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes, or to use zip codes as a proxy for protected classes, and separately makes it a violation to fail to give employees notice that artificial intelligence is being used for those purposes. The statute creates a notice duty rather than a numbered retention period, but proving that notice was given, to whom and when, is a records problem.
California went further on the records side. Its regulations on automated decision systems in employment bring automated decision system data expressly inside the set of employment records that must be preserved, alongside applications, personnel, membership and employment referral records. The practical effect is that the outputs and inputs of a screening or ranking tool become records with a retention period, held to the same four year clock.
The pattern across both is worth naming, because more states are moving in the same direction. Employment records are expanding beyond documents into the data that supported a decision. A system scoped to store files will not hold the new category, and a retention schedule written for document types will not cover it.
What This Means for the System You Buy
The requirements fall out of the rules directly: retention set per document type rather than per employee, clocks that start on the right event, physically separate stores for medical and genetic information, legal hold that suspends disposition on a defined population, a complete audit trail, and export that can produce a correct file on request.
Retention at document type level, not record level. If the retention setting lives on the employee, the system can only ever be right for one document. The setting has to live on the classified document, and classification has to happen at the point the document enters the system.
Event driven clocks. Hire date, personnel action date, termination date and end of calendar year all appear as triggers in the rules above, and the I-9 rule needs two of them compared against each other. A system that supports only a fixed number of years from upload cannot implement the federal minimum correctly.
Separate stores, separate access. The ADA, GINA and FMLA requirements are satisfied by architecture, not by a field. Medical and genetic documents belong in a store with its own access list, and the general personnel view should not be able to render them at all.
Legal hold and defensible disposition. Disposition needs to be automatic to be real, and it needs to be suspendable to be safe. When a charge is filed the relevant population has to be frozen and provably so, then released when the matter is finally disposed of.
Audit trail and export. Every access, every change, every disposition, retained and queryable. And a response function that can assemble a complete and correct file for an employee inspection request or a charge response, with the segregated material handled according to the rule rather than by the judgement of whoever is assembling it.
One structural note, because it is where most projects go wrong. None of this belongs inside the HRIS. An HRIS is a system of record for employment data, and it is good at that. It is not built to hold thirty year exposure records, to run different retention clocks per document class, or to keep two access segregated stores. VisualVault is designed to sit over the HRIS and fill those gaps rather than replace it, which is the model described on our HR information management page. The related reading on HR document management software covers the employee lifecycle view, and keeping employee records controlled after day one covers what happens to the file after onboarding closes.
Frequently Asked Questions
How long do employers have to keep employee records?
It depends on the document, not the employee. Federal rules set one year for personnel and employment records under 29 CFR 1602.14, three years for payroll records under the FLSA and the ADEA with two years for supporting records such as time cards, three years for I-9 forms from hire or one year from termination whichever is later, three years for FMLA records, five years for OSHA injury and illness records, six years for benefit plan records under ERISA, and thirty years beyond employment for occupational medical and exposure records. State law can extend these, and a filed discrimination charge suspends disposition until the matter is finally resolved.
Do employee medical records have to be stored separately from the personnel file?
Yes. The ADA at 29 CFR 1630.14 requires medical condition and history information for applicants and employees to be collected and maintained on separate forms and in separate medical files and treated as a confidential medical record. GINA at 29 CFR 1635.9 imposes the same separation on genetic information, including family medical history, as an independent requirement. The FMLA at 29 CFR 825.500 requires the same for certifications and medical histories created for FMLA purposes. The obligation is met by separate storage with separate access, not by a document type label within one file.
Does HIPAA apply to employee records held by an employer?
Generally no. The definition of protected health information at 45 CFR 160.103 excludes individually identifiable health information in employment records held by a covered entity in its role as employer. An employer holding a medical certification or a fitness for duty note in an employment record is usually not handling protected health information, and the obligations that apply are the ADA, GINA and FMLA confidentiality rules plus applicable state law. The exclusion turns on the capacity in which the record is held, so a healthcare organization can hold employment records outside HIPAA and patient records inside it at the same time.
How long do you have to keep a Form I-9 after an employee leaves?
Under 8 CFR 274a.2, a Form I-9 must be retained for three years after the date of hire or one year after the date employment is terminated, whichever is later. For an employee with more than two years of service, that resolves to one year after separation. For an employee who leaves within the first two years, it resolves to three years from the hire date. Because the rule compares two dates rather than applying a single period, it cannot be implemented with a fixed retention setting.
Can employee records management software replace an HRIS?
No, and it should not try to. An HRIS is the system of record for employment data such as job, compensation and status. Employee records management software governs the documents and the retention, confidentiality and disclosure obligations attached to them, which an HRIS is not designed to carry: different retention clocks per document class, segregated medical and genetic stores, legal hold, and thirty year occupational medical retention. The two are complementary, with the records layer sitting over the HRIS and integrating with it.
Building the Records Layer
The compliance obligation on employee records is not one rule to follow. It is a set of clocks, segregation duties and disclosure rights that only work when the system can express them separately, and that quietly fail when everything is stored in one place with one retention setting and one access list. VisualVault provides that layer over your existing HRIS: document level retention, event driven disposition with legal hold, segregated confidential stores, and a complete audit trail. Request a demo to walk through your record classes and retention schedule with our team.